Skip to content

chore(deps): bump hono in lockfile to close Dependabot alert #2 - #105

Merged
dylanneve1 merged 2 commits into
mainfrom
chore/bump-hono-lockfile-vuln
May 7, 2026
Merged

chore(deps): bump hono in lockfile to close Dependabot alert #2#105
dylanneve1 merged 2 commits into
mainfrom
chore/bump-hono-lockfile-vuln

Conversation

@claudiusthebot

@claudiusthebot claudiusthebot commented May 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Closes Dependabot alert #2 (hono <4.12.14 — HTML injection in JSX SSR, moderate).

The lockfile was pinning hono@4.12.12 even though node_modules already had 4.12.16 installed (verified via npm ls hono). GitHub reads the lockfile to determine vuln status, so the alert kept firing despite the actually-installed version being unaffected.

What changed

Surgical edit of package-lock.json: only the two relevant node_modules/<pkg> entries (version, resolved, integrity) were touched. Diff vs main is exactly 6+/6−.

package before after
hono 4.12.12 4.12.16
@hono/node-server 1.19.13 1.19.14

Integrity hashes pulled from npm view <pkg>@<ver> dist.integrity.

Why surgical (not npm install --include=optional)

The first attempt on this PR (commit d36e947) used npm install --include=optional to refresh the lockfile. That regenerated the entire optional-dep tree and removed the top-level @emnapi/core@1.10.0 entries that plain npm ci (no flags) needs to satisfy @oxc-parser/binding-wasm32-wasi's transitive deps. CI failed across 7 jobs with Missing: @emnapi/core@1.10.0 from lock file. The --include=optional approach produces a lockfile that only validates with the same flag — and CI uses plain npm ci.

Commit f041f7c reverts to main's lockfile and patches only the two relevant entries, so the lockfile stays portable for plain npm ci. Lesson encoded in ~/.talon/workspace/memory/memory.md Operational Notes for future heartbeat instances.

Test plan

  • rm -rf node_modules && npm ci (no flags) — succeeds locally
  • npx vitest run — 1635/1635 passed
  • npx tsc --noEmit — clean
  • npm run lint — 0 errors (9 pre-existing warnings)
  • CI on f041f7c: 10/10 jobs green in 1m20s (Tests Node 22+24, Functional ubuntu/macos/windows, Fuzz, Code Quality, Security Audit, Docker Build, CodeQL)

Out of scope

Leaves Dependabot alert #3 (@anthropic-ai/sdk <0.91.1, insecure default file perms in Memory tool) untouched — that one is pinned by @anthropic-ai/claude-agent-sdk@0.2.126 and needs either an upstream SDK bump or an overrides block in package.json. Flagged for live review since it could affect SDK behavior.

🤖 Heartbeat agent — picked up from #46's "next time: investigate Dependabot alerts" / fixed in #49

@claudiusthebot
chore(deps): bump hono in lockfile to close CVE alert
d36e947 
Closes Dependabot alert #2 (hono <4.12.14, HTML injection in JSX SSR).

The lockfile was pinning hono@4.12.12 even though node_modules already had
4.12.16 installed (verified via `npm ls hono`). GitHub reads the lockfile,
so the alert kept firing despite the actually-installed version being
unaffected.

`npm update hono @hono/node-server --include=optional` resolves both to
the latest version satisfying the existing transitive constraints
(`^4.11.4`, `^4`). Followed by clean install to ensure node_modules
matches.

- hono: 4.12.12 -> 4.12.16
- @hono/node-server: 1.19.13 -> 1.19.14
- emnapi optional-dep placement reshuffle (npm dedupe, no behavior change)

Tests: 1635/1635 passed. tsc clean. lint 0 errors.

Note: leaves @anthropic-ai/sdk Dependabot alert #3 untouched -- that one
needs an `overrides` block or upstream SDK bump and was flagged for live
review with Dylan.
@claudiusthebot
claudiusthebot requested a review from dylanneve1 as a code owner May 3, 2026 16:55
@claudiusthebot
fix(deps): surgical lockfile bump (only hono entries) to fix CI
f041f7c 
The previous npm install --include=optional regenerated the entire
optional-dep tree, removing @emnapi/core@1.10.0 entries that CI's
plain 'npm ci' (no --include=optional) needs. Reverting to main's
lockfile and only patching the hono and @hono/node-server entries
keeps the diff surgical and cross-platform.

Verified: 'npm ci' (no flags), 1635/1635 tests, tsc clean, 0 lint errors.
@claudiusthebot

claudiusthebot commented May 3, 2026

Copy link
Copy Markdown
Collaborator Author

CI failed on the first commit (d36e947) — npm ci (no --include=optional) errored with Missing: @emnapi/core@1.10.0 from lock file.

Root cause: my npm install --include=optional regenerated the entire optional-dep tree, removing the top-level @emnapi/core@1.10.0 entries that plain npm ci needs to satisfy @oxc-parser/binding-wasm32-wasi's transitive requirements.

Fixed in f041f7c: reset package-lock.json to main, then patched only the node_modules/hono and node_modules/@hono/node-server entries (version + integrity hash). Diff vs main is now 6+/6− — strictly the two entries that need to change to close the alert.

Verified locally:

  • npm ci (no flags) — succeeds
  • npx vitest run — 1635/1635 passed
  • npx tsc --noEmit — clean
  • npm run lint — 0 errors

CI re-running on the new commit.

@dylanneve1
dylanneve1 merged commit f0eadb5 into main May 7, 2026
13 checks passed
@dylanneve1
dylanneve1 deleted the chore/bump-hono-lockfile-vuln branch May 7, 2026 12:44
claudiusthebot added a commit that referenced this pull request May 15, 2026
@claudiusthebot
fix(codex): surgically merge lockfile — preserve main's deps + add co…
bf94035 
…dex-sdk only

CI failed on the initial codex backend PR with:

  npm error Missing: @emnapi/core@1.10.0 from lock file
  npm error Missing: @emnapi/runtime@1.10.0 from lock file

Root cause: the first `npm install --include=optional` regenerated
the lockfile broadly, dropping main's `node_modules/@emnapi/core` and
`@emnapi/runtime` top-level entries even though three packages
(rolldown wasm bindings) still listed them as dependencies. Bare
`npm ci` (no flags) on a clean runner therefore couldn't resolve
the closure.

This commit uses a Python merge script to take main's lockfile as
base and add ONLY the codex-sdk-specific entries:

  - node_modules/@openai/codex
  - node_modules/@openai/codex-{darwin,linux,win32}-{arm64,x64}
    (per-platform binaries — optional, only one installs per host)
  - node_modules/@openai/codex-sdk

Everything else in main's lockfile (tsx@4.21.0, ajv@8.18.0,
@emnapi/core@1.10.0, etc) is preserved byte-for-byte. Result:

  - bare `npm ci` passes
  - tools/verify-lockfile.sh passes
  - tsc clean
  - 2274 tests passing, 0 failing

Reapplies the §-on-lockfile-bumps lesson from PR #105: when adding a
single new dep, prefer surgical merge over a broad `npm install` so
unrelated transitive versions don't shift.
claudiusthebot added a commit that referenced this pull request May 15, 2026
@claudiusthebot
feat(backend): add Codex as a fourth backend provider (#174)
7d476b9 
* feat(backend): add Codex as a fourth backend provider

Wraps `@openai/codex-sdk` (which drives the `codex` CLI from
`@openai/codex`) and registers it as `backend: "codex"`. Selectable
alongside Claude SDK, Kilo, and OpenCode.

Reference design from https://github.com/pingdotgg/t3code — t3code's
`effect-codex-app-server` package writes its own JSON-RPC client
against the raw Codex `app-server` protocol; Talon takes the lighter
path and uses the official `@openai/codex-sdk` which already wraps
that protocol cleanly.

Architecture:

  - `constants.ts`  — system-prompt suffix, default model
    (`gpt-5-codex`).
  - `state.ts`      — per-process state container (config, cached
    Codex instance, gateway port, frontend label).
  - `mcp-config.ts` — flattens Talon's MCP plugin map into the
    `mcp_servers.<name>.{command,args,env}` TOML shape Codex's CLI
    accepts via `--config` overrides. Covers frontend-tools servers,
    plugin servers, and Brave Search.
  - `init.ts`       — lazy `Codex` instance construction, keyed by
    active chat id so per-chat MCP isolation survives the CLI's
    "configure-at-startup" constraint.
  - `handler.ts`    — main message handler. Subscribes to
    `thread.runStreamed`'s ThreadEvent generator, translates
    `agent_message` / `mcp_tool_call` items into the shared stream
    state, persists thread id for `resumeThread()` continuity.
    Hooks AbortController so terminator tools (end_turn / send /
    react) can cancel further model generation.
  - `factory.ts`    — `registerBackend({ id: "codex", ... })`.
  - `index.ts`      — barrel.

Shared infrastructure reused:
  - `backend/shared/stream-state` for accumulator.
  - `backend/shared/delivery` (routeDelivery) for end-of-turn routing.
  - `backend/shared/{prompt-format,system-prompt,model-retry,session-name,usage}`.
  - `core/tools/index.isTurnTerminator` for tool-name detection
    (Codex emits MCP calls with bare tool names, no MCP prefix —
    `stripMcpPrefix` handles both shapes).

Notes / caveats:

  - The Codex SDK doesn't expose `system` on `runStreamed`. Talon
    prepends the system prompt to the first user message on first
    turn; subsequent resumed turns inherit instructions from the
    persisted thread.
  - MCP servers are configured at thread-creation time (CLI
    constraint). Chat-id-keyed cache rebuilds the Codex instance on
    chat switch so each chat sees its own MCP environment.
  - Cache-write tokens always reported as 0 — Codex doesn't surface
    them in `Usage`.

Config:
  - New `backend: "codex"` value accepted by `configSchema`.
  - New `openaiApiKey` config option (falls back to `OPENAI_API_KEY`
    env var).

Prerequisites for the user:
  - `npm i -g @openai/codex` (provides the `codex` CLI).
  - `codex login` (ChatGPT auth) OR `OPENAI_API_KEY` env var OR
    `openaiApiKey` in `~/.talon/config.json`.

Tests: 13 new unit tests in `codex-backend.test.ts` covering
constants, state lifecycle, MCP-config flattening (frontend servers,
plugin servers, brave-search opt-in, multi-frontend), and factory
registration. Full suite 2274 passing (was 2261), 12 skipped
(live-tier), 0 failing.

README:
  - Backends badge updated to include Codex.
  - "Backends" section gains a Codex row.
  - Prerequisites + config-table rows updated.
  - Architecture tree adds `codex/`.

Live verification: not exercised — requires `codex` CLI installed +
OpenAI API key. A `docker/codex-test/` harness can be added in a
follow-up similar to `docker/kilo-test/` once the SDK has been
shaken out against real usage.

* fix(codex): surgically merge lockfile — preserve main's deps + add codex-sdk only

CI failed on the initial codex backend PR with:

  npm error Missing: @emnapi/core@1.10.0 from lock file
  npm error Missing: @emnapi/runtime@1.10.0 from lock file

Root cause: the first `npm install --include=optional` regenerated
the lockfile broadly, dropping main's `node_modules/@emnapi/core` and
`@emnapi/runtime` top-level entries even though three packages
(rolldown wasm bindings) still listed them as dependencies. Bare
`npm ci` (no flags) on a clean runner therefore couldn't resolve
the closure.

This commit uses a Python merge script to take main's lockfile as
base and add ONLY the codex-sdk-specific entries:

  - node_modules/@openai/codex
  - node_modules/@openai/codex-{darwin,linux,win32}-{arm64,x64}
    (per-platform binaries — optional, only one installs per host)
  - node_modules/@openai/codex-sdk

Everything else in main's lockfile (tsx@4.21.0, ajv@8.18.0,
@emnapi/core@1.10.0, etc) is preserved byte-for-byte. Result:

  - bare `npm ci` passes
  - tools/verify-lockfile.sh passes
  - tsc clean
  - 2274 tests passing, 0 failing

Reapplies the §-on-lockfile-bumps lesson from PR #105: when adding a
single new dep, prefer surgical merge over a broad `npm install` so
unrelated transitive versions don't shift.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dylanneve1 dylanneve1 Awaiting requested review from dylanneve1 dylanneve1 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@claudiusthebot @dylanneve1