From e45a8bbbd5e837439391801eaa0977a9c50d3995 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Thu, 9 Jul 2026 14:26:45 -0700 Subject: [PATCH] chore(deps): align TypeScript on 6.0.3 Signed-off-by: Carlos Villela --- .../e2e-weather-plugin-fixture-dependency-review.md | 6 +++--- nemoclaw/package-lock.json | 8 ++++---- nemoclaw/package.json | 2 +- nemoclaw/tsconfig.json | 1 + package-lock.json | 8 ++++---- package.json | 2 +- test/e2e/fixtures/plugins/weather/package-lock.json | 8 ++++---- test/e2e/fixtures/plugins/weather/package.json | 2 +- 8 files changed, 19 insertions(+), 18 deletions(-) diff --git a/docs/security/e2e-weather-plugin-fixture-dependency-review.md b/docs/security/e2e-weather-plugin-fixture-dependency-review.md index 30623981595..a47fba67212 100644 --- a/docs/security/e2e-weather-plugin-fixture-dependency-review.md +++ b/docs/security/e2e-weather-plugin-fixture-dependency-review.md @@ -3,7 +3,7 @@ # E2E Weather Plugin Fixture Dependency Review -Review date: 2026-07-08 +Review date: 2026-07-09 Scope: `test/e2e/fixtures/plugins/weather/package-lock.json` and the secret-free OpenClaw custom-plugin lifecycle regression lane. @@ -45,11 +45,11 @@ Run from `test/e2e/fixtures/plugins/weather`: npm audit --package-lock-only --ignore-scripts --json ``` -Revalidated on 2026-07-08: npm audit exited `1` and reported 9 vulnerable packages (3 moderate and 6 high; 0 info, low, or critical) across 374 total dependencies. +Revalidated on 2026-07-09: npm audit exited `1` and reported 9 vulnerable packages (3 moderate and 6 high; 0 info, low, or critical) across 374 total dependencies. The affected packages are `@earendil-works/pi-coding-agent`, `@openclaw/fs-safe`, `hono`, `linkify-it`, `markdown-it`, `openclaw`, `protobufjs`, `tar`, and `undici`. The point-in-time advisory set is GHSA-22p9-wv53-3rq4, GHSA-2gcr-mfcq-wcc3, GHSA-35p6-xmwp-9g52, GHSA-38rv-x7px-6hhq, GHSA-3hrh-pfw6-9m5x, GHSA-6v5v-wf23-fmfq, GHSA-7v5m-pr3q-6453, GHSA-88fw-hqm2-52qc, GHSA-94rc-8x27-4472, GHSA-9c3v-684m-579c, GHSA-f38q-mgvj-vph7, GHSA-f577-qrjj-4474, GHSA-g8m3-5g58-fq7m, GHSA-j6c9-x7qj-28xf, GHSA-jfgx-wxx8-mp94, GHSA-mqxh-6gq7-558m, GHSA-p88m-4jfj-68fv, GHSA-pr7r-676h-xcf6, GHSA-r95r-rj6r-c39x, GHSA-rv63-4mwf-qqc2, GHSA-vmf3-w455-68vh, GHSA-vmh5-mc38-953g, GHSA-vxpw-j846-p89q, GHSA-wcpc-wj8m-hjx6, GHSA-wgpf-jwqj-8h8p, GHSA-wwfh-h76j-fc44, and GHSA-xrhx-7g5j-rcj5. The advisories are in the release-pinned OpenClaw development graph; the Docker build suppresses lifecycle scripts and prunes development and peer dependencies before copying the plugin into the runtime image. -The reviewed lockfile has SHA-256 `1fa44d136d4bf5396f592dbf901da2c43740b38f1ebe52d23efc01ca0ba6f3da`, and every non-root package entry records both its resolved registry URL and integrity value. +The reviewed lockfile has SHA-256 `ea5fcb849fbc39ef2c9dd1d893258d373a9c3eae796306951f8c2e180cf6469c`, and every non-root package entry records both its resolved registry URL and integrity value. The audit is a point-in-time advisory check, not a substitute for the exact lockfile, lifecycle-script suppression, or secret-free workflow boundary. Rerun it whenever `package.json` or `package-lock.json` changes and again before merge if npm advisory state changes. diff --git a/nemoclaw/package-lock.json b/nemoclaw/package-lock.json index aafa3e101d8..5cd0a2f1adb 100644 --- a/nemoclaw/package-lock.json +++ b/nemoclaw/package-lock.json @@ -17,7 +17,7 @@ "devDependencies": { "@biomejs/biome": "^2.4.14", "@types/node": "^22.0.0", - "typescript": "^5.4.0", + "typescript": "6.0.3", "vitest": "^4.1.0" }, "engines": { @@ -1578,9 +1578,9 @@ "optional": true }, "node_modules/typescript": { - "version": "5.9.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", - "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz", + "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==", "dev": true, "license": "Apache-2.0", "bin": { diff --git a/nemoclaw/package.json b/nemoclaw/package.json index e42fdbee4c1..171a8cdfd21 100644 --- a/nemoclaw/package.json +++ b/nemoclaw/package.json @@ -38,7 +38,7 @@ "devDependencies": { "@biomejs/biome": "^2.4.14", "@types/node": "^22.0.0", - "typescript": "^5.4.0", + "typescript": "6.0.3", "vitest": "^4.1.0" }, "engines": { diff --git a/nemoclaw/tsconfig.json b/nemoclaw/tsconfig.json index 1a5057ed1d3..0c14c54c9b7 100644 --- a/nemoclaw/tsconfig.json +++ b/nemoclaw/tsconfig.json @@ -13,6 +13,7 @@ "declaration": true, "declarationMap": true, "sourceMap": true, + "types": ["node"], "resolveJsonModule": true }, "include": ["src/**/*"], diff --git a/package-lock.json b/package-lock.json index 24f0a65c94e..663cd9f56a3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -38,7 +38,7 @@ "ajv": "^8.17.0", "fast-check": "^4.8.0", "tsx": "^4.21.0", - "typescript": "^6.0.2", + "typescript": "6.0.3", "vitest": "^4.1.9" }, "engines": { @@ -6472,9 +6472,9 @@ "license": "MIT" }, "node_modules/typescript": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.2.tgz", - "integrity": "sha512-bGdAIrZ0wiGDo5l8c++HWtbaNCWTS4UTv7RaTH/ThVIgjkveJt83m74bBHMJkuCbslY8ixgLBVZJIOiQlQTjfQ==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz", + "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==", "dev": true, "license": "Apache-2.0", "bin": { diff --git a/package.json b/package.json index 58aed3b22b2..cfc1ef92d2e 100644 --- a/package.json +++ b/package.json @@ -118,7 +118,7 @@ "ajv": "^8.17.0", "fast-check": "^4.8.0", "tsx": "^4.21.0", - "typescript": "^6.0.2", + "typescript": "6.0.3", "vitest": "^4.1.9" } } diff --git a/test/e2e/fixtures/plugins/weather/package-lock.json b/test/e2e/fixtures/plugins/weather/package-lock.json index e58ef537b83..843090108a1 100644 --- a/test/e2e/fixtures/plugins/weather/package-lock.json +++ b/test/e2e/fixtures/plugins/weather/package-lock.json @@ -13,7 +13,7 @@ }, "devDependencies": { "openclaw": "2026.5.27", - "typescript": "5.9.3" + "typescript": "6.0.3" }, "engines": { "node": ">=22.16.0" @@ -5136,9 +5136,9 @@ "license": "MIT" }, "node_modules/typescript": { - "version": "5.9.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", - "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz", + "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==", "dev": true, "license": "Apache-2.0", "bin": { diff --git a/test/e2e/fixtures/plugins/weather/package.json b/test/e2e/fixtures/plugins/weather/package.json index 9f0399b2ae6..1aaf92fc892 100644 --- a/test/e2e/fixtures/plugins/weather/package.json +++ b/test/e2e/fixtures/plugins/weather/package.json @@ -30,7 +30,7 @@ }, "devDependencies": { "openclaw": "2026.5.27", - "typescript": "5.9.3" + "typescript": "6.0.3" }, "peerDependencies": { "openclaw": ">=2026.5.17"