Repository navigation
Sync/upstream v1.2 - #1
Merged
Merged
Conversation
- apt-get upgrade in Dockerfile runtime stage (Debian OS CVEs) - override fast-uri to ^3.1.3 (was 3.1.0) - override fast-xml-builder to ^1.1.7 (was 1.1.3) - override fast-xml-parser to ^5.5.6 (was 5.4.1) - override ip-address to ^10.3.1 (was 10.1.0) - override path-to-regexp to ^8.4.0 (was 8.3.0) - bump hono to ^4.12.25 (was 4.12.7, direct dependency)
…wser-extension-rewrite feat: add browser companion protocol
…ency-advisories fix(deps): remediate v1.2.0 dependency advisories
…adiness Release 1.2.0: Homebrew, reliable search, and model retry
…shed-homebrew docs: confirm published v1.2 Homebrew installation
CATCHUP-v1.2.md documents how to merge upstream/main (goniszewski/grimoire v1.2.0) into this fork while preserving the local Trivy CVE patch branch (fix/security-cve-2026-09), with the concrete overrides to drop/keep after the merge. upstream-sync.yml runs weekly and opens/updates a PR whenever upstream/main gets ahead, so drift is surfaced automatically instead of relying on manual checks. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ync/upstream-v1.2 # Conflicts: # daemon/bun.lock # daemon/package.json
Separate from quality.yml (upstream-owned) so future upstream syncs never conflict here. Runs an fs scan of dependencies plus a build-and-scan of the Docker image on PRs and pushes to main, failing on new fixable HIGH/CRITICAL findings. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- upstream-sync.yml: stop interpolating step outputs directly into run: shell blocks (script-injection pattern); pass them via env: instead. - trivy.yml: pin aquasecurity/trivy-action to a full commit SHA (also fixes the tag itself, which was missing the "v" prefix and unresolvable). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Root bun.lock (used by the Dockerfile builder stage) was never regenerated when the upstream merge bumped package.json (react-router-dom 6->7, vite 5->6, vitest 3->4), so `bun install --frozen-lockfile` broke the Docker build in CI. package-lock.json (npm, used by quality.yml) was already consistent via the upstream merge. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
recharts@2.15.4 pins a lodash range (^4.17.21) that resolves to the vulnerable 4.17.21. Force it to >=4.18.0 (fixed version) via an npm/bun override, matching the pattern already used in daemon/package.json. Verified locally: trivy fs --severity HIGH,CRITICAL now reports 0 findings across bun.lock, daemon/bun.lock and package-lock.json. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.