Repository navigation
chore: update all dependencies to latest, pnpm 8 → 12, fix audit findings - #6
Merged
Merged
Conversation
…dings pnpm 8.15.9 -> 12.9.1: - Settings migrated to pnpm-workspace.yaml (pnpm 10+ no longer reads the package.json pnpm field): security overrides moved, plus the allowBuilds map for dependency build scripts and minimumReleaseAge: 0 (the agent SDKs publish multiple times daily; the committed frozen lockfile is the vetting point). - Lockfile regenerated in the v9 format (root + .deepsec workspace). Dependencies to latest: - Runtime: @anthropic-ai/claude-agent-sdk 0.3.292, @openai/codex + codex-sdk 0.160.1, @earendil-works/pi-coding-agent 1.0.4 (0.81.1 -> 1.0 migrated: setRuntimeApiKey no longer takes allowNetwork), @vercel/sandbox 3.5.1 (sandboxId -> name API migration), @vercel/oidc 4.0.0, zod 4.6.5 (z.record(key, value) migration), glob 13, ink 8, commander 15, dotenv 18, esbuild 0.28.2, undici 8.11.2, jiti 2.7.0, tar, jsonrepair 3.15, minimatch. - Dev: vitest 5.0.3 (workspace file -> root config test.projects), biome 2.5.15 (+ config migrated), knip 6.40 (+ redundant entries removed), typescript 7.0.2, tsx 4.23.15. - Website: next 16.3.0-preview.9 -> 16.4.0 stable, eslint 10.12.0, eslint-config-next 16.4.0, feed 6.0.0, react/react-dom 19.3.0, @types/node 26. @vercel/geistdocs and fumadocs-mdx stay on their known-good majors (1.15.5 / 14.0.4) — both need a website UI/config migration and are tracked separately. Audit: 21 advisories -> 1: - Fixed via updates + overrides: undici 8.x (15 advisories), tinypool/ vitest 3.2.7 (3, via the vitest 5 bump), katex (mermaid transitive), @vitest/mocker. - Remaining: braces GHSA-vfj7-8cjw-p6xm — no patched version exists (3.0.3 is the latest release), dev-only path via the website's eslint chain, never shipped in the npm package. Validated: build (incl. TS 7 + dts-bundle-generator), lint, knip, .deepsec typecheck, 2457 unit tests + 29 bundle e2e tests, and a live scan -> process run through the OpenCode v2 backend on the updated stack.
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
pnpm 8.15.9 → 12.9.1
pnpm-workspace.yaml(pnpm 10+ ignores thepackage.json#pnpmfield): security overrides moved,allowBuildsmap for dependency build scripts,minimumReleaseAge: 0(the agent SDKs publish multiple times daily — the committed frozen lockfile is the vetting point).deepsec)All dependencies to latest
setRuntimeApiKeyoptions) · @vercel/sandbox 3.5.1 (sandboxId→nameAPI migration) · @vercel/oidc 4.0.0 · zod 4.6.5 (z.record(key, value)migration) · glob 13 · ink 8 · commander 15 · dotenv 18 · esbuild 0.28.2 · undici 8.11.2 · jiti · tar · jsonrepair 3.15test.projectsconfig) · biome 2.5.15 (+ config migration) · knip 6.40 · typescript 7.0.2 (the native port — full build incl. dts-bundle-generator passes) · tsx 4.23.15Audit: 21 advisories → 1
Verification
.deepsectypecheck: clean