chore(deps,middleware)(deps): bump better-sqlite3 from 12.11.1 to 13.0.3 in /middleware - #596
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
9 tasks
Weegy
added a commit
that referenced
this pull request
Aug 5, 2026
* chore(deps): consolidated dependency batch 2026-08-04 Supersedes 11 individual Dependabot PRs with one verified batch. npm (middleware): - @modelcontextprotocol/sdk 1.29.0 -> 1.30.0 (harness-orchestrator) - @aws-sdk/client-s3 3.1095.0 -> 3.1102.0 - @azure/msal-node 5.4.2 -> 5.4.3 - bonjour-service 1.4.3 -> 1.4.4 - jose 6.2.4 -> 6.2.8 npm (web-ui): - lucide-react 1.27.0 -> 1.28.0 - framer-motion 12.42.2 -> 12.43.0 - jsdom 29.1.1 -> 30.0.1 (major, dev) - @types/react 19.2.17 -> 19.2.18 - @types/react-dom 19.2.3 -> 19.2.4 - @vitejs/plugin-react 6.0.4 -> 6.0.5 docker: - node 22.23.1-slim -> 22.23.2-slim (Dockerfile, web-ui, dev-runner) - node 22.23.1-alpine -> 22.23.2-alpine (dev-runner-daemon) ci: - actions/download-artifact v7 -> v8 (major) aws-sdk and jose resolve one patch beyond the Dependabot proposals, which were cut a day earlier. Excluded, with reasons in the PR body: typescript 7.0.2 (#595, blocked by typescript-eslint peer range) and better-sqlite3 13.0.2 (#596, drops the prebuild-install hook so it compiles from source in a slim image that has no Python). * fix(deps): bump brace-expansion override to 5.0.9 (clears 15 high advisories) The `brace-expansion` override in both workspaces pinned 5.0.8, which a new advisory now flags as high: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (vulnerable: >=4.0.0 <5.0.9) Because the pin was exact, npm held the vulnerable version in place and `npm update` could not move it. Bumping the pin to 5.0.9 clears the whole cascade: web-ui went from 15 high advisories to 0 (the eslint / typescript-eslint tree was flagged only transitively through brace-expansion -> minimatch), and middleware from 4 to 1. This is not a regression from this branch — main is red on the same gate (run 30887391724). npm's audit registry endpoint recovered on 2026-08-04, so the workflow's "audit endpoint returned an error" bypass stopped firing and pre-existing advisories became blocking for the first time. The remaining middleware advisory is fast-uri 3.1.4 (<3.1.5, host confusion via backslash authority introducer), reached through ajv@8.20.0. Deliberately NOT fixed here: npm only re-applies a changed override during a full lockfile regeneration, and regenerating drags in 75 unrelated package changes including a @hono/node-server 1.19 -> 2.1 major. That belongs in its own reviewed PR, not a dependency batch. * fix(deps): pin fast-uri 3.1.5 to clear the last high advisory Closes the remaining `audit (high+critical block) (middleware)` failure: fast-uri: host confusion via backslash authority introducer (vulnerable: >=3.0.0 <3.1.5) Reached through ajv@8.20.0, which requires `fast-uri: ^3.0.1`. ajv is already at its latest release, so there is no upstream fix to take. The `overrides` entry is bumped to 3.1.5 and the single lockfile entry is moved to match. This is deliberately surgical: npm refuses to re-apply a changed override to an already-locked transitive dependency (`npm ls` prints `fast-uri@3.1.4 invalid: "3.1.5" ... overridden` and does nothing), and the only npm-native way to make it re-resolve -- deleting the lockfile and regenerating -- rewrites 75 unrelated package versions, including a @hono/node-server 1.19.17 -> 2.1.0 major and a hoisting change that splits ajv@8 into five per-workspace copies. None of that belongs in a dependency batch, so the lockfile is edited to exactly the entry a correct resolution would produce instead. The integrity hash is the registry's own for 3.1.5, and `npm ci` verifies it against the downloaded tarball, so the pin is not taken on trust. Verified: npm ci clean, `npm ls fast-uri` reports no invalid markers, build + lint + typecheck pass, 5502 tests pass / 0 fail, ajv relative $ref resolution (the code path that uses fast-uri) still resolves, and the audit gate exits 0.
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/middleware/better-sqlite3-13.0.2
branch
from
August 5, 2026 11:04
c269bd9 to
a0b19b8
Compare
5 tasks
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/middleware/better-sqlite3-13.0.2
branch
from
August 7, 2026 10:55
a0b19b8 to
d879781
Compare
Bumps [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) from 12.11.1 to 13.0.3. - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.3) --- updated-dependencies: - dependency-name: better-sqlite3 dependency-version: 13.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/middleware/better-sqlite3-13.0.2
branch
from
August 9, 2026 10:09
d879781 to
f34f830
Compare
Contributor
Author
|
Superseded by #637. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/middleware/better-sqlite3-13.0.2
branch
August 10, 2026 04:22
Weegy
added a commit
that referenced
this pull request
Aug 11, 2026
Closes the last open Dependabot PR (#596), which proposed 13.0.2 and failed CI on `middleware (build, no push)`. better-sqlite3 v13 is the N-API rewrite: the addon no longer targets a specific Node ABI and ships prebuilt binaries for linux/darwin/win32 (glibc and musl) inside the package. Taking 13.0.3 rather than the proposed 13.0.2 — it adds the arm64 prebuild CI fix. Why #596 failed, and why this does not: `npm ci` runs `node-gyp rebuild` on better-sqlite3 even though the package declares `gypfile: false` and ships a matching prebuild. `npm install` honors the field; `npm ci` does not. Verified as a 5-line reproduction on npm 10.9.8, 11.19.0 and 12.0.2 in node:22.23.2-slim, so upgrading npm is not a fix. The slim image has no Python, so the gyp build dies at `find Python`. Both `npm ci` invocations in the root Dockerfile therefore pass `--ignore-scripts`, which lets the bundled prebuild be used, and then rebuild the packages that genuinely need their install script: argon2 and esbuild in the builder stage, argon2 alone in the runtime stage (esbuild is dev-only). Both fetch prebuilt binaries, so no compiler is needed there either. Those are the only two — the lockfile lists exactly 4 install scripts, the other two being this package itself and optional fsevents. `ensure-native-abi.mjs` had to be rewritten: it probed a hardcoded `build/Release/better_sqlite3.node`, which v13 never produces, so it failed outright (exit 1) and broke `npm run dev` — after first running a pointless rebuild. The ABI-mismatch class of bug it guarded is structurally gone under N-API, so the rebuild path is removed; what remains is an end-to-end probe that opens an in-memory DB and runs a query, which also catches a corrupt install or a platform without a prebuild. Verified in both directions. check-node-version.mjs keeps its behavior; only its rationale is corrected, since it cited the now-impossible ABI clobber. Verified: - docker build --platform linux/amd64 succeeds, zero gyp/Python output - in the built runtime image: better-sqlite3 13.0.3 opens a DB and queries, argon2 hashes and verifies (argon2id), sharp encodes a PNG - middleware build, lint, typecheck clean; 5502 tests pass / 0 fail - npm audit --audit-level=high exits 0 - lockfile drops `bindings` and `prebuild-install` entirely (-246 lines)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps better-sqlite3 from 12.11.1 to 13.0.3.
Release notes
Sourced from better-sqlite3's releases.
... (truncated)
Commits
dbc2ea113.0.3b872585use Ubuntu 22.04-arm (#1510)569e85a13.0.2df1324bfix: this dependabot configuration does not set a co... in... (#1508)b9fbe5ffixed segfault from making calls while worker thread is terminating71707c4validate the parameters of table properly (#1504)6478c99Update SQLite to version 3.53.4 (#1506)6d24034add gypfile option to package.json (#1505)ab6232efixed typo in docs57d751cupdated readmeNeed help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.