Skip to content

fix(security): upgrade vulnerable production dependencies #8126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sandl99 wants to merge 9 commits into from
Closed

fix(security): upgrade vulnerable production dependencies #8126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
15cbd3f
fix(security): audit root production dependencies
sandl99 Aug 3, 2026
3ab72f3
test(security): cover root audit enforcement
sandl99 Aug 3, 2026
fb42b51
fix(security): validate root audit registry
sandl99 Aug 3, 2026
1a99d46
Merge branch 'main' into fix/npm-audit-8116
prekshivyas Aug 3, 2026
06e4ae1
fix(security): keep root remediation dependency-only
apurvvkumaria Aug 3, 2026
c565121
merge(main): refresh security dependency upgrade
prekshivyas Aug 3, 2026
b853d68
fix(security): upgrade vulnerable undici runtime
apurvvkumaria Aug 3, 2026
0bd5c09
merge: align root remediation with trusted audit
apurvvkumaria Aug 3, 2026
7f7f383
Merge remote-tracking branch 'origin/pr/8126' into codex/pr-8126-finish
prekshivyas Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/pr-review-advisor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ jobs:
# Workflow-boundary modules parse YAML before the advisor session starts.
YAML_VERSION: "2.8.3"
# Embedded Pi SDK sessions use Pi's proxy-aware Undici transport.
UNDICI_VERSION: "8.5.0"
UNDICI_VERSION: "8.10.0"
# Credential-free inventory discovery executes the trusted Vitest entrypoint.
VITEST_VERSION: "4.1.9"
FD_FIND_VERSION: "9.0.0-1"
Expand Down
44 changes: 27 additions & 17 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@
"p-retry": "^4.6.2",
"qrcode-terminal": "^0.12.0",
"smol-toml": "1.7.0",
"undici": "8.5.0",
"undici": "8.10.0",
"yaml": "2.8.3"
},
"bundleDependencies": [
Expand Down
4 changes: 2 additions & 2 deletions test/package-contract/managed-image-registry-transport.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ describe("managed image registry transport package contract", () => {
const productionDependencies = JSON.parse(productionTree.stdout) as {
dependencies?: { undici?: { version?: string } };
};
expect(productionDependencies.dependencies?.undici?.version).toBe("8.5.0");
expect(productionDependencies.dependencies?.undici?.version).toBe("8.10.0");

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-managed-registry-package-"));
try {
Expand Down Expand Up @@ -80,7 +80,7 @@ describe("managed image registry transport package contract", () => {
const installedProductionDependencies = JSON.parse(installedProductionTree.stdout) as {
dependencies?: { undici?: { version?: string } };
};
expect(installedProductionDependencies.dependencies?.undici?.version).toBe("8.5.0");
expect(installedProductionDependencies.dependencies?.undici?.version).toBe("8.10.0");

const probe = spawnSync(
process.execPath,
Expand Down
6 changes: 3 additions & 3 deletions test/pr-review-advisor-workflow-boundary.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1310,7 +1310,7 @@ process.exitCode = valid ? 0 : 1;`,
const errors = validateMutation((source) =>
source
.replace(' FD_FIND_VERSION: "9.0.0-1"', ' FD_FIND_VERSION: "latest"')
.replace(' UNDICI_VERSION: "8.5.0"', ' UNDICI_VERSION: "latest"')
.replace(' UNDICI_VERSION: "8.10.0"', ' UNDICI_VERSION: "latest"')
.replace(' VITEST_VERSION: "4.1.9"', ' VITEST_VERSION: "latest"')
.replace(' YAML_VERSION: "2.8.3"', ' YAML_VERSION: "latest"')
.replace(
Expand All @@ -1322,7 +1322,7 @@ process.exitCode = valid ? 0 : 1;`,
expect(errors).toEqual(
expect.arrayContaining([
"review job env.FD_FIND_VERSION must be 9.0.0-1",
"review job env.UNDICI_VERSION must be 8.5.0",
"review job env.UNDICI_VERSION must be 8.10.0",
"review job env.VITEST_VERSION must be 4.1.9",
"review job env.YAML_VERSION must be 2.8.3",
"review job env.PR_REVIEW_ADVISOR_LOAD_PREVIOUS_REVIEW must be false",
Expand Down Expand Up @@ -1380,7 +1380,7 @@ process.exitCode = valid ? 0 : 1;`,
expect.arrayContaining([
"advisor package lock must pin @earendil-works/pi-coding-agent@0.80.6",
"advisor package lock must pin typebox@1.1.38",
"advisor package lock must pin undici@8.5.0",
"advisor package lock must pin undici@8.10.0",
"advisor package lock must pin yaml@2.8.3",
"advisor package lock must pin vitest@4.1.9",
]),
Expand Down
2 changes: 1 addition & 1 deletion tools/pr-review-advisor/workflow-boundary.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ const FORBIDDEN_ARTIFACT_DOWNLOAD_WITH_KEYS = [
const ADVISOR_RUNTIME_PACKAGE_PINS = [
{ packageName: "@earendil-works/pi-coding-agent", envName: "PI_SDK_VERSION", version: "0.80.6" },
{ packageName: "typebox", envName: "TYPEBOX_VERSION", version: "1.1.38" },
{ packageName: "undici", envName: "UNDICI_VERSION", version: "8.5.0" },
{ packageName: "undici", envName: "UNDICI_VERSION", version: "8.10.0" },
{ packageName: "yaml", envName: "YAML_VERSION", version: "2.8.3" },
{ packageName: "vitest", envName: "VITEST_VERSION", version: "4.1.9" },
] as const;
Expand Down
Loading