weichen/Agent-System-Dev
1
0
Fork 0
Code Issues 1 Pull Requests 6 Actions 2 Packages Projects Releases Wiki Activity

Pin backend, frontend, and ui gitlinks past reachable security advisories #88

Merged
weichen merged 4 commits from fix/dep-vuln-bumps into main 2026-09-30 16:50:21 +00:00
Conversation 0 Commits 4 Files Changed 5
+42 -3
4 Commits
Author SHA1 Message Date
weichen 20850ac220 Record the sync checkpoint
ci / test (pull_request) Failing after 1m31s
Details
2026-09-30 16:49:57 +00:00
weichen 21a92441dc Merge remote-tracking branch 'origin/main' into fix/dep-vuln-bumps 2026-09-30 16:49:57 +00:00
weichen 641dc6e159 Pin backend, frontend, and ui gitlinks past reachable security advisories 
Why: dependency CVE inventory follow-up — backend govulncheck had two reachable vulnerabilities (GO-2026-5004 pgx SQL injection via placeholder confusion, GO-2026-5970 x/text infinite loop via pgx.Connect) and frontend/ui npm audit flagged GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal); all fixed by version bumps merged in the respective repos (Backend#23, Frontend#19, UI#18).
Evidence: gitlinks pinned to backend 41cebd3, frontend af03854, ui daf73be; combined verification make test exit 0 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend govulncheck now reports 0 reachable (was 2), both frontend repos npm audit clean (was 2 moderate each).
Impact: three gitlink pins + task card only; no Dev-repo source change; vitest stays on 4.1.11 (first fixed release) rather than 5.x.
Refs: .task/fix-dep-vuln-bumps.md
 2026-09-30 16:49:56 +00:00
weichen c974ea7d69 Record the task card for fix-dep-vuln-bumps 2026-09-30 16:43:31 +00:00