From 641dc6e159e58aab35d5300c11dccca46e11c56d Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Wed, 30 Sep 2026 16:49:56 +0000
Subject: [PATCH] Pin backend, frontend, and ui gitlinks past reachable
 security advisories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: dependency CVE inventory follow-up — backend govulncheck had two reachable vulnerabilities (GO-2026-5004 pgx SQL injection via placeholder confusion, GO-2026-5970 x/text infinite loop via pgx.Connect) and frontend/ui npm audit flagged GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal); all fixed by version bumps merged in the respective repos (Backend#23, Frontend#19, UI#18).
Evidence: gitlinks pinned to backend 41cebd3, frontend af03854, ui daf73be; combined verification make test exit 0 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend govulncheck now reports 0 reachable (was 2), both frontend repos npm audit clean (was 2 moderate each).
Impact: three gitlink pins + task card only; no Dev-repo source change; vitest stays on 4.1.11 (first fixed release) rather than 5.x.
Refs: .task/fix-dep-vuln-bumps.md
---
 .task/fix-dep-vuln-bumps.md | 15 ++++++++++++++-
 modules/backend             |  2 +-
 modules/frontend            |  2 +-
 modules/ui                  |  2 +-
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.task/fix-dep-vuln-bumps.md b/.task/fix-dep-vuln-bumps.md
index d9c7c933..81970184 100644
--- a/.task/fix-dep-vuln-bumps.md
+++ b/.task/fix-dep-vuln-bumps.md
@@ -6,7 +6,14 @@
 
 - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 0b0540e2d251ed6bee77e63fb1ed174dda3ddd41
 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-fix-dep-vuln-bumps（worktree）；分支：fix/dep-vuln-bumps
-- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 授权与交付终点：落地依赖 CVE 清单中所有可达/可修项——backend 升 pgx 与 x/text、frontend/ui 升 vitest，并经组合验证后钉入三个 gitlink；终点为四个子仓 PR + Dev gitlink PR 全部合入后回收 worktree。
+- 权威依据：2026-09-30 govulncheck（backend 2 条可达：GO-2026-5004、GO-2026-5970）与 npm audit（frontend/ui 各 2 条 moderate：GHSA-82fw-gwwq-j7x9）。
+
+## 目标与非目标
+
+- 目标：backend `golang.org/x/text v0.24.0→v0.39.0`、`github.com/jackc/pgx/v5 v5.7.6→v5.9.2`（两条可达漏洞归零）；frontend/ui `vitest`+`@vitest/mocker` →`4.1.11`（GHSA-82fw-gwwq-j7x9 修复首版）；Dev 钉入三仓新 main。
+- 非目标：不处理 govulncheck 报的 20 条 module 级不可达项与 2 条 import 级不可达项（信息性，工具确认代码未调用）；不升 vitest 到 5.x（保守取修复边界版）。
+- <本次允许的动作与终点；未授权事项写明>
 
 ## 目标与非目标
 
@@ -23,3 +30,9 @@
 - 结果：
 - 验证：
 - 影响与剩余项：
+
+## 结果与验证
+
+- 结果：backend PR #23（260dcc2，main=41cebd3）、frontend PR #19（a61bd70，main=af03854）、ui PR #18（780cc11，main=daf73be）全部合入；Dev 钉入三 gitlink。
+- 验证：backend `go build`+`go test -count=1 ./...` 绿且 govulncheck 复核"affected by 0 vulnerabilities"（原 2）；frontend/ui `npm audit` "found 0 vulnerabilities"（原各 2），vitest 套件 33/33 与 37/37 绿（ui 曾被管道截断摘要，已单独补验 exit 0）；Dev `make test` 全链 exit 0。
+- 影响与剩余项：均为依赖版本升级（backend 生产依赖 2 个、前端 devDependency 1 个）；剩余项为 20 条不可达 module 级通告（信息性，随 routine 升级自然消化），无阻断项。
diff --git a/modules/backend b/modules/backend
index f98dc1dd..41cebd3b 160000
--- a/modules/backend
+++ b/modules/backend
@@ -1 +1 @@
-Subproject commit f98dc1ddd4ab82f915e949c47f5ab35c49c78ac6
+Subproject commit 41cebd3b65e539d74b6d0cd4122b80657688642e
diff --git a/modules/frontend b/modules/frontend
index b067b579..af038545 160000
--- a/modules/frontend
+++ b/modules/frontend
@@ -1 +1 @@
-Subproject commit b067b5797501747bc80a8ee963ddfd01cdfca191
+Subproject commit af0385451a32f15e2b71c7a762ed863bad6545b7
diff --git a/modules/ui b/modules/ui
index 1d7c235e..daf73be2 160000
--- a/modules/ui
+++ b/modules/ui
@@ -1 +1 @@
-Subproject commit 1d7c235ec5d99453279e0d20db258ecd0545f4ec
+Subproject commit daf73be2868b0531217f4bf41687282a19dcff45