refactor: sync opencode cli core - #46
Merged
Merged
Conversation
8 tasks
13 tasks
Astro-Han
added a commit
that referenced
this pull request
Jul 27, 2026
Root cause: - The repository pinned vulnerable parser, site, updater, packaging, router, CSS-processing, glob-expansion, and native image-processing dependencies. - The remaining brace-expansion advisory had no compatible backport for the older minimatch releases retained by lint and packaging tooling. Change boundary: - Upgrade pypdf and Astro to patched releases. - Override vulnerable site and root transitive dependencies to patched versions. - Upgrade electron-updater and the Electron Builder family together, including the explicit Windows Squirrel peer. - Resolve every brace-expansion chain to 5.0.8 and patch only its CommonJS export shape so minimatch 3, 5, and 9 remain callable while minimatch 10 retains the named expand export. - Add a compatibility regression test covering every installed minimatch release. Verification: - Root and site Bun audits report zero high or critical findings. - Frozen installs, site production build, desktop typecheck, root lint, desktop production build, and a real macOS Electron startup passed. - PDF parser smoke passed with pypdf and pdfplumber. - Targeted desktop updater and packaging tests passed. - Full PR CI passed across macOS, Windows, E2E, CodeQL, dependency review, and CodeRabbit. Review follow-ups and residual risk: - No unresolved review threads remain. - sharp 0.35.3 is intentionally forced above Astro 6.4.6's optional range. The site does not use astro:assets and its production build passes; revisit this constraint if the image pipeline is adopted. - Full signed installer production remains release-pipeline coverage. Related work: - No product issue. This work was driven by Dependabot alerts #88, #87, and #46 plus the repository-wide Bun audit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
packages/opencode/src/cli/**core slice to upstreamv1.4.11packages/opencode/src/cli/cmd/tui/**packages/opencode/test/cli/run.test.tshelper test as part of the upstream syncWhy
PawWork still relies on vendored
packages/opencodeas foundation infrastructure. This PR keeps the CLI core slice aligned with upstream semantics in the PR 6 lane, reduces architectural drift, and preserves PawWork-specific fit where upstream behavior would mislead users or leak sensitive export data.Related Issue
Part of #27
How To Verify
Manual checks: none, no visible UI changes in this slice.
Screenshots or Recordings
N/A
Checklist
devbranch