Repository navigation
fix(deps): refresh dependencies, base image and CI actions - #79
Merged
Merged
Conversation
…gnment, lib-vuetify peer trap) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Clears the shipped critical (proxy-addr IP spoofing) and the other in-range advisories: npm audit 16 -> 8 (prod 10 -> 2 low), trivy on the built image 1 CRITICAL / 2 MEDIUM / 1 LOW -> 0. Base image node 24.21.0. Declared floors raised to what the lockfile now resolves, so a fresh resolve cannot pair them wrongly: lib-express 1.29 peers lib-node ^2.15, lib-vuetify >=2.5.1 needs lib-vue >=1.31. lib-node 2.14 makes its default axios/agents refuse non-public addresses (SSRF). Model listing for org-configured providers uses that instance, so an admin-supplied private baseURL is now refused with an explicit message - intended in production, but it would block the documented dev bridge on localhost:3194, so dev-api sets SSRF_PUBLIC_IPS to loopback. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- api: axios, only reached through @data-fair/lib-node/axios.js, which brings its own; declared at the root instead, where tests import its types - ui: @ai-sdk/openai (never imported by the ui) and @mcp-b/webmcp-polyfill (imported by lib-vue, which declares it); declare @mcp-b/webmcp-ts-sdk, which ui/src/transports imports directly Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@types/node 22 -> 24 to match the Dockerfile, CI and .nvmrc major. Root tsc and ui vue-tsc pass unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- checkout v4 -> v7, setup-node v3 -> v7, setup-buildx v3 -> v4, login v3 -> v4, metadata v5 -> v6, build-push v5 -> v7 (node 24 runtimes; none of the inputs used here were renamed or removed) - battila7/get-version-action: replaced by a shell step deriving the major from GITHUB_REF_NAME (v0.11.0 -> 0, same as before) - bcoe/conventional-release-labels (node12 runtime, last release 2022): replaced by a shell step with the same title -> label mapping, through the same REST endpoint, which creates a missing label such as "breaking" Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
dotenv 18 ships a `dotenv` bin that takes node_modules/.bin/dotenv over dotenv-cli's whatever the install order, and `dotenv -- cmd` then prints usage and exits 1 (CI's backgrounded dev-api would have died silently). So dotenv-cli goes and every call becomes `dotenv run -- cmd`. Checked equivalent: 17 and 18 parse the repo's .env identically; .env uses no variable expansion (the only dotenv-cli feature dropped); shell variables still win over .env; args, exit codes, stdio and signals pass through. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
lib-node 2.14's default agents refuse loopback (SSRF guard), and the test clients, the state-setup ping and dev fixtures all address the dev stack on localhost: every api spec failed at state-setup. Those URLs come from our own configuration, which is what lib-node's private agents are for. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine dependency refresh: clear the shipped advisories, update within existing ranges and the node base image, remove dead dependencies, take the majors proven safe, and move CI off old or unmaintained actions. The AI SDK v7 major is postponed until
feat-autonomous-agentslands.node:24.21.0-alpine3.24. Clears the shipped critical (proxy-addrIP spoofing). npm audit 16 → 8 (shipped: 10 → 2 low). Trivy on the built image: 1 critical, 2 medium, 1 low → 0.axios, ui@ai-sdk/openaiand ui@mcp-b/webmcp-polyfill. Declared@mcp-b/webmcp-ts-sdk, which ui imports directly.@types/node22 → 24, to match the node 24 we ship.dotenvcommand replaces dotenv-cli's, so every call becomesdotenv run -- …. Checked that.envparsing, precedence, arguments, exit codes and signals behave as before.battila7/get-version-actionandbcoe/conventional-release-labels(node12 runtime, last release 2022) replaced with shell steps that apply the same labels.Why: routine upkeep, starting with security.
Heads-up:
openai-compatibleprovider whosebaseURLpoints at a private address now shows a listing error. Self-hosted deployments that need this must setSSRF_PUBLIC_IPS.fetchand is unaffected. That gap was already there.SSRF_PUBLIC_IPS=127.0.0.1,::1innpm run dev-api, for the local Claude Code bridge. The test clients now use lib-node's private agents.releases.yml(version step) runs only on a tag, so it stays untested until the next release.conventional-label.yamlruns onpull_request_target, which uses main's copy, so the first PR after merge is its first real run.@mcp-b6, zod 4, katex (mermaid 11 and 12 both require 0.16), braces (dev only, no fixed version exists).feat-autonomous-agents: its newdotenv -- …scripts (dev-mcp,dev-load-check) must becomedotenv run -- ….