chore(deps): apply security dependency rollup - #2000
Merged
Conversation
added 6 commits
June 22, 2026 23:32
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📝 WalkthroughWalkthroughPlaywright replaces crawl4ai in the docs crawler scripts and modal app, with new HTML-to-Markdown and metadata helpers. Rust demo binaries gain feature-gated manifests, Linux Wayland input routing changes, cua-bench preprocessing moves local, TypeScript computer WebSocket/file-command updates land, and Python package/test manifests are updated. ChangesDocs crawler migration
Demo binary gating and runtime bumps
Linux Wayland input and macOS protocol updates
cua-bench preprocessing and constraints
TypeScript computer interface and package updates
Python server and sandbox alignment
Python agent package refresh
Python CLI and train cleanup
Sequence Diagram(s)Docs crawl flow sequenceDiagram
participant CuaDocsCrawler
participant Browser
participant page
participant html_to_markdown
participant extract_metadata
CuaDocsCrawler->>Browser: new_page()
Browser-->>CuaDocsCrawler: page
CuaDocsCrawler->>page: goto(url, wait_until="networkidle")
page-->>CuaDocsCrawler: content() and title()
CuaDocsCrawler->>html_to_markdown: page_html
CuaDocsCrawler->>extract_metadata: page_html, title
html_to_markdown-->>CuaDocsCrawler: markdown
extract_metadata-->>CuaDocsCrawler: description
Wayland inject_click flow sequenceDiagram
participant send_command_for
participant inject_click
participant inject_send
send_command_for->>inject_click: route Wayland click in inject mode
inject_click->>inject_send: send move/press/release batch
Estimated code review effort🎯 5 (Critical) | ⏱️ ~90+ minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
📦 Publishable packages changed
Add |
Codecov ReportCaution This repository is currently using the Sentry GitHub App to receive Codecov PR comments. This integration will be deprecated on July 8, 2026. Please install the Codecov GitHub App to continue receiving coverage reports on your pull requests. 📢 Thoughts on this report? Let us know! |
Contributor
Linux visual regression artifactsMatrix jobs now run independently. Download visual artifacts from this workflow run.
|
Contributor
📦 Publishable packages changed
Add |
Contributor
📦 Publishable packages changed
Add |
Contributor
📦 Publishable packages changed
Add |
Contributor
📦 Publishable packages changed
Add |
Contributor
📦 Publishable packages changed
Add |
| from urllib.parse import urljoin, urlparse | ||
|
|
||
| from crawl4ai import AsyncWebCrawler, BrowserConfig, CrawlerRunConfig | ||
| from playwright.async_api import Browser, async_playwright |
Collaborator
There was a problem hiding this comment.
as long as this is tested i'm okay with this https://github.com/trycua/cua/pull/2000/changes#diff-27409390ac3c10d48b2974fa32fc3e45efb665c72a93154ae7884b77384dabc1L12
but its stable and working so i'd prefer not to change and use the same lib; could we possiblt fix security issues by upgrading the library ?
iirc this is running in modal as well and afaik we don't have secrets in that environment so it might be safe to ignore
this script powers our docs ingest for ask ai on docs and our vibe coding mcp server so those both break if this breaks
| // owner thread isn't started yet (which is the normal X11-only case). | ||
| if crate::wayland::is_wayland() { | ||
| let _ = crate::wayland::overlay::forward(&msg); | ||
| #[cfg(target_os = "linux")] |
The Playwright crawler walked the whole page body, so every crawled page began with the sidebar/nav tree — identical boilerplate that polluted the docs search / Ask-AI corpus. Scope extraction to the <article> (fallback <main>) container and drop nav/aside/footer chrome; code blocks and prose are unaffected. Also document the one-time 'playwright install chromium' step for local runs (the Modal image already installs it).
Contributor
📦 Publishable packages changed
Add |
0xjohnnydev
marked this pull request as ready for review
June 24, 2026 20:24
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
libs/cua-driver/rust/crates/cua-driver/tests/mcp_protocol_test.rs (1)
319-329: 🎯 Functional Correctness | 🟡 MinorRestore
screenshotin the expected tool list
ScreenshotTool.handleris included inToolRegistry.default, so this assertion should still cover it; removing it leaves the default registry under-tested.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@libs/cua-driver/rust/crates/cua-driver/tests/mcp_protocol_test.rs` around lines 319 - 329, The expected tool list in the MCP protocol test is missing the screenshot tool, so the default registry is no longer fully asserted. Update the `expected` array in `mcp_protocol_test.rs` to include `screenshot` alongside the other default tools, using the `ToolRegistry.default`/`ScreenshotTool.handler` coverage as the reference point, so the test continues to validate the full default tool set.
🧹 Nitpick comments (2)
libs/python/computer-server/tests/test_server.py (1)
116-143: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueBrittle exact-substring assertions on serialized JSON.
'"id":1' in response.textdepends on compact, space-free JSON serialization. If the underlying serializer ever emits"id": 1, this passes today but is fragile. Consider parsing the response (handling the SSEdata:framing from thetext/event-streamaccept) and asserting on the decodedid/server name instead of raw substrings.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@libs/python/computer-server/tests/test_server.py` around lines 116 - 143, The initialize HTTP test in test_mcp_http_app_accepts_initialize_post is asserting against raw serialized JSON text, which is brittle. Update the test to parse the response payload (including handling any text/event-stream data framing) and assert on the decoded response fields such as id and the server name from create_mcp_server/http_app instead of checking exact substrings in response.text.libs/python/computer-server/computer_server/handlers/_grpc_emulator/emulator_controller_pb2.py (1)
7-7: 📐 Maintainability & Code Quality | 🔵 TrivialRegenerate the emulator stubs
The generated header still saysProtobuf Python Version: 6.31.1while the pin isprotobuf==6.33.6. It’s compatible, but the stub is out of sync with the dependency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@libs/python/computer-server/computer_server/handlers/_grpc_emulator/emulator_controller_pb2.py` at line 7, Regenerate the protobuf emulator stubs so the generated Python stub metadata matches the pinned protobuf dependency version. Update the generated output for the emulator controller protobuf artifacts, especially the emulation stub module identified by emulator_controller_pb2, using the project’s protobuf generation workflow so the header/version comment reflects protobuf==6.33.6 instead of 6.31.1.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/scripts/modal_app.py`:
- Around line 390-400: The crawl in the page navigation flow is using page.goto
with wait_until set to networkidle, which can incorrectly time out on pages with
long-lived background requests. Update the navigation in the modal_app.py crawl
logic to use a less strict load condition in the page.goto call, and keep the
existing response handling that checks response.ok and marks failed_urls for
real HTTP failures.
In `@libs/python/agent/pyproject.toml`:
- Line 55: The glm45v-hf extra currently pins a prerelease Transformers floor
without an apparent code dependency, so either remove that requirement or add a
clear justification tied to a Hugging Face-backed GLM-4.5V path. Check the
`glm45v-hf` extra in the agent pyproject and confirm whether
`cua_agent/loops/glm45v.py` or any related HF integration actually imports or
needs `transformers`; if not, drop the pin and keep the extra minimal.
---
Outside diff comments:
In `@libs/cua-driver/rust/crates/cua-driver/tests/mcp_protocol_test.rs`:
- Around line 319-329: The expected tool list in the MCP protocol test is
missing the screenshot tool, so the default registry is no longer fully
asserted. Update the `expected` array in `mcp_protocol_test.rs` to include
`screenshot` alongside the other default tools, using the
`ToolRegistry.default`/`ScreenshotTool.handler` coverage as the reference point,
so the test continues to validate the full default tool set.
---
Nitpick comments:
In
`@libs/python/computer-server/computer_server/handlers/_grpc_emulator/emulator_controller_pb2.py`:
- Line 7: Regenerate the protobuf emulator stubs so the generated Python stub
metadata matches the pinned protobuf dependency version. Update the generated
output for the emulator controller protobuf artifacts, especially the emulation
stub module identified by emulator_controller_pb2, using the project’s protobuf
generation workflow so the header/version comment reflects protobuf==6.33.6
instead of 6.31.1.
In `@libs/python/computer-server/tests/test_server.py`:
- Around line 116-143: The initialize HTTP test in
test_mcp_http_app_accepts_initialize_post is asserting against raw serialized
JSON text, which is brittle. Update the test to parse the response payload
(including handling any text/event-stream data framing) and assert on the
decoded response fields such as id and the server name from
create_mcp_server/http_app instead of checking exact substrings in
response.text.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2ff8d936-c1f1-4a91-8b6e-ee0f63e9171a
⛔ Files ignored due to path filters (12)
docs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlexamples/computer-example-ts/package-lock.jsonis excluded by!**/package-lock.jsonexamples/computer-example-ts/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamllibs/cua-bench/uv.lockis excluded by!**/*.locklibs/cua-driver/rust/Cargo.lockis excluded by!**/*.locklibs/cuabot/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamllibs/python/cua-cli/uv.lockis excluded by!**/*.locklibs/python/cua-sandbox-apps/uv.lockis excluded by!**/*.locklibs/python/cua-sandbox/uv.lockis excluded by!**/*.locklibs/typescript/computer/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamllibs/typescript/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamluv.lockis excluded by!**/*.lock
📒 Files selected for processing (41)
demo/jukebox/app/Cargo.tomldemo/jukebox/orchestrator/Cargo.tomldemo/multi-cursor/electron/package.jsondemo/multi-cursor/legacy-app/Cargo.tomldemo/multi-cursor/orchestrator/Cargo.tomldocs/package.jsondocs/scripts/README.mddocs/scripts/crawl_docs.pydocs/scripts/modal_app.pyexamples/computer-example-ts/package.jsonlibs/cua-bench/cua_bench/workers/dataloader.pylibs/cua-bench/pyproject.tomllibs/cua-driver/rust/crates/cua-driver/tests/mcp_protocol_test.rslibs/cua-driver/rust/crates/platform-linux/Cargo.tomllibs/cua-driver/rust/crates/platform-linux/src/health_report.rslibs/cua-driver/rust/crates/platform-linux/src/overlay.rslibs/cua-driver/rust/crates/platform-linux/src/tools/impl_.rslibs/cua-driver/rust/crates/platform-linux/src/wayland/mod.rslibs/cua-driver/rust/crates/platform-macos/build.rslibs/cuabot/package.jsonlibs/python/agent/cua_agent/proxy/examples.pylibs/python/agent/cua_agent/ui/gradio/ui_components.pylibs/python/agent/pyproject.tomllibs/python/computer-server/computer_server/handlers/_grpc_emulator/emulator_controller_pb2.pylibs/python/computer-server/pyproject.tomllibs/python/computer-server/tests/test_server.pylibs/python/cua-cli/cua_cli/auth/store.pylibs/python/cua-cli/tests/conftest.pylibs/python/cua-sandbox-apps/pyproject.tomllibs/python/cua-sandbox/cua_sandbox/transport/_grpc_emulator/emulator_controller_pb2.pylibs/python/cua-sandbox/pyproject.tomllibs/python/cua-train/src/cua_train/client.pylibs/typescript/agent/package.jsonlibs/typescript/computer/package.jsonlibs/typescript/computer/src/interface/base.tslibs/typescript/computer/tests/interface/macos.test.tslibs/typescript/core/package.jsonlibs/typescript/package.jsonlibs/typescript/playground/package.jsonnix/cua-driver/tests/wayland/cursor-click-gif.nixpyproject.toml
Comment on lines
+390
to
+400
| response = await page.goto( | ||
| url, | ||
| wait_until="networkidle", | ||
| timeout=30_000, | ||
| ) | ||
|
|
||
| if response is None or not response.ok: | ||
| status = response.status if response else "no response" | ||
| print(f"Failed to crawl {url}: HTTP {status}") | ||
| failed_urls.add(url) | ||
| continue |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Confirm all Modal/local Playwright navigation wait states before release.
rg -n -C 3 'page\.goto\([^)]*wait_until=["'\'']networkidle["'\'']' docs/scriptsRepository: trycua/cua
Length of output: 745
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files docs/scripts | sed -n '1,20p'
printf '\n--- modal_app.py outline ---\n'
ast-grep outline docs/scripts/modal_app.py --view expanded
printf '\n--- crawl_docs.py outline ---\n'
ast-grep outline docs/scripts/crawl_docs.py --view expanded
printf '\n--- modal_app.py around relevant lines ---\n'
sed -n '360,420p' docs/scripts/modal_app.py
printf '\n--- crawl_docs.py around relevant lines ---\n'
sed -n '230,270p' docs/scripts/crawl_docs.pyRepository: trycua/cua
Length of output: 8126
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate every Playwright navigation call and its wait state in docs/scripts.
rg -n -C 2 'page\.goto\(' docs/scriptsRepository: trycua/cua
Length of output: 923
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the crawl loop's timeout/error handling to gauge impact.
sed -n '380,460p' docs/scripts/modal_app.py
printf '\n---\n'
sed -n '242,330p' docs/scripts/crawl_docs.pyRepository: trycua/cua
Length of output: 6564
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check whether there are any alternative wait states or retries elsewhere in docs/scripts.
rg -n 'wait_until=|networkidle|domcontentloaded|load|commit|timeout=30_000|retry' docs/scriptsRepository: trycua/cua
Length of output: 6416
Avoid networkidle here Long-lived background requests will hit the 30s timeout, mark the URL as failed, and skip indexing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/scripts/modal_app.py` around lines 390 - 400, The crawl in the page
navigation flow is using page.goto with wait_until set to networkidle, which can
incorrectly time out on pages with long-lived background requests. Update the
navigation in the modal_app.py crawl logic to use a less strict load condition
in the page.goto call, and keep the existing response handling that checks
response.ok and marks failed_urls for real HTTP failures.
| "accelerate", | ||
| "torch", | ||
| "transformers-v4.55.0-GLM-4.5V-preview" | ||
| "transformers>=5.0.0rc3" |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n '\b(from|import) transformers\b|\btransformers\.' libs/python/agent/cua_agent
rg -n 'glm45v-hf|transformers>=5\.0\.0rc3|transformers-v4\.55\.0-GLM-4\.5V-preview' libs/python/agent/pyproject.toml libs/python/agentRepository: trycua/cua
Length of output: 1767
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the dependency section around the changed extra.
sed -n '40,70p' libs/python/agent/pyproject.toml
# Inspect the moondream3 and related transformer-using modules to see whether
# the transformers dependency is already required by the codepaths.
sed -n '1,120p' libs/python/agent/cua_agent/loops/moondream3.py
printf '\n---\n'
sed -n '1,120p' libs/python/agent/cua_agent/loops/holo.py
printf '\n---\n'
sed -n '1,120p' libs/python/agent/cua_agent/adapters/huggingfacelocal_adapter.pyRepository: trycua/cua
Length of output: 13616
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the surrounding dependency groups and any other references to glm45v-hf.
rg -n -C 2 'glm45v-hf|transformers>=5\.0\.0rc3|transformers-v4\.55\.0-GLM-4\.5V-preview' libs/python/agent/pyproject.toml libs/python/agent
# Inspect the package metadata for extras and optional dependency grouping.
python3 - <<'PY'
from pathlib import Path
text = Path('libs/python/agent/pyproject.toml').read_text()
for needle in ['[project.optional-dependencies]', 'glm45v-hf', 'moondream3', 'holo', 'huggingfacelocal']:
print(f"\n## {needle}")
for i, line in enumerate(text.splitlines(), 1):
if needle in line:
start = max(1, i-3)
end = min(len(text.splitlines()), i+3)
for j in range(start, end+1):
print(f"{j}: {text.splitlines()[j-1]}")
PYRepository: trycua/cua
Length of output: 1479
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the specific dependency stanza with line numbers for accurate context.
nl -ba libs/python/agent/pyproject.toml | sed -n '48,60p'
# Show the transformer-dependent modules to assess whether the dependency is already justified elsewhere.
nl -ba libs/python/agent/cua_agent/loops/moondream3.py | sed -n '1,90p'
printf '\n---\n'
nl -ba libs/python/agent/cua_agent/loops/holo.py | sed -n '1,90p'
printf '\n---\n'
nl -ba libs/python/agent/cua_agent/adapters/huggingfacelocal_adapter.py | sed -n '1,80p'Repository: trycua/cua
Length of output: 188
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find all glm45v-related codepaths and see whether the new extra maps to a real module.
rg -n -C 3 'glm45v' libs/python/agent
# Show the GLM-4.5V loop implementation if present.
fd -a 'glm45v.py|*glm45v*' libs/python/agentRepository: trycua/cua
Length of output: 2975
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the GLM-4.5V loop imports and any direct transformers usage.
sed -n '1,120p' libs/python/agent/cua_agent/loops/glm45v.py
printf '\n---\n'
rg -n '\btransformers\b|AutoModel|AutoProcessor|from_pretrained|smart_resize' libs/python/agent/cua_agent/loops/glm45v.pyRepository: trycua/cua
Length of output: 3856
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the top of the GLM-4.5V implementation to determine whether it relies on transformers directly.
sed -n '1,140p' libs/python/agent/cua_agent/loops/glm45v.py
# Search for any direct transformer-related symbols in that file.
rg -n '\btransformers\b|AutoModel|AutoProcessor|from_pretrained|smart_resize' libs/python/agent/cua_agent/loops/glm45v.pyRepository: trycua/cua
Length of output: 4617
Remove or justify the transformers>=5.0.0rc3 pin in glm45v-hf. libs/python/agent/cua_agent/loops/glm45v.py is litellm-based and doesn’t import transformers, so this extra shouldn’t carry a Transformers prerelease floor unless there’s a separate HF-backed GLM-4.5V path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@libs/python/agent/pyproject.toml` at line 55, The glm45v-hf extra currently
pins a prerelease Transformers floor without an apparent code dependency, so
either remove that requirement or add a clear justification tied to a Hugging
Face-backed GLM-4.5V path. Check the `glm45v-hf` extra in the agent pyproject
and confirm whether `cua_agent/loops/glm45v.py` or any related HF integration
actually imports or needs `transformers`; if not, drop the pin and keep the
extra minimal.
r33drichards
approved these changes
Jun 24, 2026
r33drichards
pushed a commit
that referenced
this pull request
Jun 25, 2026
…acked fix The cursor-click-gif tests (kde, xfce-labwc, gnome, xfce-sway) all pass since the EIS-backed cua-compositor injection path landed in #2000. Remove the stale 'TDD RED suite' / 'X11-only today' / 'EXPECTED TO FAIL' language that no longer reflects reality. Closes CUA-656.
r33drichards
added a commit
that referenced
this pull request
Jun 25, 2026
…acked fix (#2028) The cursor-click-gif tests (kde, xfce-labwc, gnome, xfce-sway) all pass since the EIS-backed cua-compositor injection path landed in #2000. Remove the stale 'TDD RED suite' / 'X11-only today' / 'EXPECTED TO FAIL' language that no longer reflects reality. Closes CUA-656. Co-authored-by: OpenClaw <openclaw@trycua.com>
This was referenced Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies the dependency-security rollup prepared on
security/dependabot-rollup-20260623.This includes:
Definition of Done
Validation
Ran locally:
Security comparison:
Package audits checked zero vulnerabilities for root, docs,
libs/typescript,libs/cuabot, andexamples/computer-example-tsafter the HUD extra was restored.GitHub PR checks:
gh pr checks 2000 --repo trycua/cua # 87/87 checks passing on 1558a990Additional blocker follow-up validation:
Computer-server CI-equivalent follow-up:
Post-HUD-restore security re-check:
Summary by CodeRabbit
New Features
Bug Fixes
Chores