chore(deps): resolve Dependabot security advisories (363 → 1) - #3
Merged
Conversation
Clears the Dependabot alert digest for this repo. Audit (pnpm 9): 363 vulnerabilities (7 critical) -> 1 (1 low, no upstream fix). Primary fix: bump openclaw 2026.3.28 -> 2026.6.5. ~271 of the flagged advisories were transitive deps reached through openclaw's tree; the newer release carries updated sub-deps. Typecheck + build pass on the bump. Direct/dev deps refreshed within range via pnpm update (viem, tsdown, tsx, typescript, @types/node, vite 8.1.5, @noble/hashes, @scure/bip39, @sinclair/typebox, @clawnch/*). vite reaches the 8.0.5 security floor. pnpm.overrides pin the remaining flagged transitive leaves to patched versions (tree-wide, since parents pin them below the fix): tar 7.5.16, ws 8.20.1, js-yaml 4.1.2, immutable 4.3.9, brace-expansion 2.1.2, follow-redirects 1.15.12, undici (6.23 / 8.5 lines), cookie 0.7, tmp 0.2.4, adm-zip 0.6, serialize-javascript 7.0.5, uuid 11.1.1, @hono/node-server 2.0.5. Held vitest at 4.1.2 (the version resolved on master) — 4.1.10 changed test scheduling and increased flakiness of a pre-existing racy test (tests/v4-user-tools.test.ts, shared-state leak; flakes on clean master too). Not touched here; unrelated to these deps. Remaining: elliptic (1 low, GHSA transitive via ethers>@uniswap/v4-sdk) has no published fix — latest is 6.6.1. Nothing to upgrade to yet.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears the Dependabot alert digest for this repo. Local audit (pnpm 9): 363 vulnerabilities (7 critical) → 1 (1 low, no upstream fix).
What changed (
package.json+pnpm-lock.yamlonly)Primary fix — bump
openclaw2026.3.28→2026.6.5. ~271 of the flagged advisories were transitive deps reached through openclaw's tree (.>openclaw>@mariozechner/pi-*>@google/genai>@modelcontextprotocol/sdk>express>…). The newer release carries updated sub-deps and prunes the tree (hence the large lockfile shrink). Not a prerelease (2026.7.xis; skipped it).In-range refresh via
pnpm update— viem, tsdown, tsx, typescript, @types/node, vite → 8.1.5 (clears the 8.0.5 security floor), @noble/hashes, @scure/bip39, @sinclair/typebox, @clawnch/* SDKs.pnpm.overridespin the remaining flagged transitive leaves to patched versions tree-wide (their parents pin them below the fix):tar 7.5.16(clears the 1 critical) ·ws 8.20.1·js-yaml 4.1.2·immutable 4.3.9·brace-expansion 2.1.2·follow-redirects 1.15.12·undici(6.23 + 8.5 lines) ·cookie 0.7·tmp 0.2.4·adm-zip 0.6·serialize-javascript 7.0.5·uuid 11.1.1·@hono/node-server 2.0.5.Verification
tsc --noEmit: cleanpnpm build: passes (both build steps)pnpm test: 1546 passed / 31 skipped — parity with masterNot fixed (documented)
elliptic(1 low) — transitive viaethers > @uniswap/v4-sdk(in@clawnch/clawncher-sdk). No published fix — npm latest is6.6.1; the advisory's patched6.6.2doesn't exist yet. Nothing to upgrade to.Notes for reviewer
vitestheld at4.1.2(the version resolved on master).4.1.10changed test scheduling and increased flakiness of a pre-existing racy test —tests/v4-user-tools.test.ts("enables and disables tools") leaks shared state across tests and flakes on clean master too (verified: master fails it intermittently with zero of my changes). Out of scope here; worth a separate test-isolation fix (the service consults a shared singleton ingetEnabledTools()).