Repository navigation
fix(security): patch vulnerable build and publishing dependencies - #27
Merged
Merged
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patch the verified Vite, Vitest, DOMPurify, and certifi advisories while keeping unrelated dependency versions fixed. Vite is now 6.4.5, Vitest 4.1.12, the Monaco DOMPurify override 3.4.17, and hash-pinned publishing certifi 2026.10.19.
Validation: npm clean install, production UI build, npm audit (zero vulnerabilities), HTTP 96 passed / 1 Windows-only skip, workspace 27 passed, and UI 3,969 passed across 310 files with NODE_OPTIONS=--no-webstorage on Node 26.9.0. The default Node 26 UI run failed on localStorage; the runtime-specific rerun and original failure are both documented. All workflows remain manual/reusable; no GitHub Actions was dispatched.
This is the narrow hotfix before the ancestry-preserving upstream merge campaign. Native HTTP serves compiled embedded assets, so upstream DeusData#2757 is not a filesystem-serving fix for this fork. Existing workspace default-deny behavior is preserved. The integration batch separately addresses the observed 289 MiB binary exceeding the existing 256 MiB archive-member ceiling; this PR does not claim installer compatibility is resolved.
Jenkins exact-SHA full qualification and native Windows checks remain pending. Agent-Workflow worker source/test evidence is retained separately from lifecycle acceptance: the initial compatibility run lacked bound acceptance commands and remains unaccepted. See docs/upstream-sync/security.md for advisory links, exact upstream commits, hashes, adaptations, and verification details. Draft only; do not merge automatically.
Publication validation follow-up: the first push produced an invalid-workflow record with zero jobs because the pre-existing reusable
_test.ymlhad duplicateifkeys. Combine those conditions while retainingworkflow_callas its only trigger. Repaired security and guard pushes produced no new Actions records at follow-up inspection; no hosted runner job ran. The strict stacked guard now rejects duplicate keys anywhere in workflow YAML.