weichen 641dc6e159 Pin backend, frontend, and ui gitlinks past reachable security advisories ...

Why: dependency CVE inventory follow-up — backend govulncheck had two reachable vulnerabilities (GO-2026-5004 pgx SQL injection via placeholder confusion, GO-2026-5970 x/text infinite loop via pgx.Connect) and frontend/ui npm audit flagged GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal); all fixed by version bumps merged in the respective repos (Backend#23, Frontend#19, UI#18).
Evidence: gitlinks pinned to backend 41cebd3, frontend af03854, ui daf73be; combined verification make test exit 0 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend govulncheck now reports 0 reachable (was 2), both frontend repos npm audit clean (was 2 moderate each).
Impact: three gitlink pins + task card only; no Dev-repo source change; vitest stays on 4.1.11 (first fixed release) rather than 5.x.
Refs: .task/fix-dep-vuln-bumps.md

2026-09-30 16:49:56 +00:00

..

backend @ 41cebd3b65

Pin backend, frontend, and ui gitlinks past reachable security advisories

2026-09-30 16:49:56 +00:00

core @ c9aff06ed5

Pin submodule pointers to their remote mains

2026-09-30 16:34:06 +00:00

documents @ 1f3e7ab441

Pin submodule pointers to their remote mains

2026-09-30 16:34:06 +00:00

frontend @ af0385451a

Pin backend, frontend, and ui gitlinks past reachable security advisories

2026-09-30 16:49:56 +00:00

ui @ daf73be286

Pin backend, frontend, and ui gitlinks past reachable security advisories

2026-09-30 16:49:56 +00:00