Repository navigation
chore(deps): update dependencies and fix audit findings - #239
Conversation
- daemon: update in-range deps (MCP SDK 1.32, hono 4.13.16, aws-sdk, sqlite-vec, zod) and bump pinned overrides that were themselves vulnerable (fast-uri, ip-address, body-parser, qs, @hono/node-server); add proxy-addr 2.0.8 override (critical IP spoofing advisory) - frontend: npm audit fix + in-range updates (vite 6.4.5, react-query, radix, eslint 9.39, typescript 5.9); remove unused zod; pin postcss-selector-parser to 6.1.5 - fix daemon type errors from TS 5.9 Uint8Array<ArrayBufferLike> typing - Tags: call deleteTag explicitly, react-query now passes a second mutationFn argument - tests: await async elements in Settings and TagDetail tests
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4c2b7990a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "overrides": { | ||
| "postcss-selector-parser": "6.1.5" |
There was a problem hiding this comment.
The root bun.lock still includes the removed zod dependency and has no postcss-selector-parser override, so it no longer matches this manifest. Both the frontend lockfile gate in .github/workflows/quality.yml and the builder install in Dockerfile use bun install --frozen-lockfile; Bun's help defines that flag as “Disallow changes to lockfile.” Updating only package-lock.json therefore leaves CI and Docker builds unable to reconcile the new dependency configuration. Regenerate and commit the root Bun lockfile alongside the npm lockfile.
Useful? React with 👍 / 👎.
|
Summary
Dependency and security update across the frontend and daemon.
Daemon (
bun audit: 22 findings incl. 1 critical, 8 high -> 0)overrideswere themselves vulnerable. Bumpfast-uri,ip-address,body-parser,qsand@hono/node-server.proxy-addr2.0.8 override (critical IP-spoofing advisory GHSA-jqcg-44mw-7w3h).tscerrors from TS 5.9Uint8Array<ArrayBufferLike>typing (backup/package.ts,bookmark-media.test.ts). Type-only, no behavior change.Frontend (
npm audit: 21 findings incl. 3 high -> 12 moderate, dev-only)npm audit fixand in-range updates (vite 6.4.5, react-query 5.105, radix, eslint 9.39, typescript 5.9).zoddependency (nothing imports it) instead of migrating to zod 4.postcss-selector-parserto 6.1.5 viaoverrides.Tags.tsx: calldeleteTag(id)explicitly. react-query >= 5.91 passes an extra context argument tomutationFn.Settings.test.tsxandTagDetail.test.tsx; react-query >= 5.91 resolves slightly later and the synchronousgetBy*calls raced.Review notes
@hono/node-serveroverride moves 1.x -> 2.1.6. The MCP SDK declares^1.19.9 || ^2.0.5; the daemon suite passes, but worth a glance.minimatchin the eslint / typescript-eslint chain (lint-time only). The only fix is a major eslint 10 upgrade, which is out of scope here.Verification
npm run lint: 0 errorsnpm run type-check: frontend and daemon cleannpm test: 358/358; daemonbun test: 720/720npm run buildandnpm run docs:api:check: passbun audit: no vulnerabilities