Skip to content

chore: harden tanstack supply-chain pins - #423

Closed
myth05 wants to merge 2 commits into
outsourc-e:mainfrom
myth05:security/tanstack-supply-chain-hardening-20260512
Closed

chore: harden tanstack supply-chain pins#423
myth05 wants to merge 2 commits into
outsourc-e:mainfrom
myth05:security/tanstack-supply-chain-hardening-20260512

Conversation

@myth05

@myth05 myth05 commented May 12, 2026

Copy link
Copy Markdown

Summary

  • harden repo npm config against supply-chain attacks
  • pin direct @TanStack dependencies to the already-locked safe versions
  • keep pnpm lockfile resolved tree committed

Verification

  • checked lockfile against Mini Shai-Hulud/TanStack indicators: no 1.169.5, no 1.169.8, no unscoped tanstack 2.0.4-2.0.7, no router_init.js, no @tanstack/setup, no 79ac49eedf, no voicproducoes
  • pnpm install --frozen-lockfile --ignore-scripts passes

outsourc-e and others added 2 commits April 25, 2026 01:01
… 404ing (outsourc-e#80) (outsourc-e#155)

When a backend PTY exits (user typed exit, command crashed, server
recycled), the SSE stream emits 'event: exit' followed by 'event: close'.
The frontend was ignoring both events, so the tab kept its now-dead
sessionId. Subsequent /api/terminal-input and /api/terminal-resize
calls then 404'd in a tight loop and the user saw a hung terminal until
they reloaded.

Fix: handle 'exit' and 'close' events in the SSE consumer:
- Print a dim '[session ended (exit code N)]' line into xterm so the
  user knows what happened.
- Clear the tab's sessionId in zustand state. handleSendInput and the
  resize effect both already short-circuit when sessionId is undefined,
  so the 404 spam stops immediately.
- Print a hint that '+' opens a new tab.

Auto-reconnect is intentionally not implemented here \u2014 the upstream
issue was just the spurious 404s and frozen UI. If we want a 'restart
session' button later, we wire it on the same handler.

Co-authored-by: Eric <eric@outsourc-e.com>
@outsourc-e

Copy link
Copy Markdown
Owner

Closing as superseded by #432. The validated fix was folded into the consolidated batch branch fix/issue-sweep-batch-20260514 for one review/merge path.

@outsourc-e outsourc-e closed this May 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants