Repository navigation
fix(deps): refresh vulnerable transitive resolutions in bun.lock - #7654
Conversation
Lockfile-only targeted refresh within existing parent ranges: protobufjs 7.6.6, @grpc/grpc-js 1.14.7, source-map-js 1.2.2, brace-expansion 2.1.7 / 5.0.12, form-data 2.5.6, fast-uri 3.1.9, js-yaml 4.3.2, browserslist 4.29.5, baseline-browser-mapping 2.11.35, ws 8.22.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Edit accuracy: accurate 267 (base branch 267), smooth 100 of thoseThe gate passes. Quarantined, measured but not gated (8)
Unstable (2)
|
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at 4ac4e26c6606e4e7d0d78b240134e8aa13dcc395. No blockers found.
Parsed comparison confirms bun.lock is the only changed file; workspace declarations and overrides are identical. All changed package versions stay within their existing major versions and satisfy parent ranges. The adjacent changes match protobufjs/form-data/browser-data dependency floors, removal of unused @protobufjs/inquire, and ws deduplication; no unexpected package additions were found. Both Lambda runtime locks are unchanged.
Validation: frozen install and full build pass. Local dependency smoke checks pass for protobuf encode/decode, source-map roundtrip, YAML loading, brace expansion and WebSocket echo. Audit against this PR's base is 117→77 with no new advisory IDs; none of the targeted packages remains in the audit output. The description's 111 baseline is not what the current audit returns. Hosted checks have no failures at this head. The other dependency PRs touch bun.lock too, so preserve their selected versions when rebasing whichever lands later.
Need: yes, patched transitive resolutions · Size: ok · Reuse: existing dependency ranges · Simpler: already minimal · Structure: fine (checked parent dependency edges and unchanged workspace declarations; no split)
Risk: low — compatible transitive patches/minors with unchanged source and passing build/smoke coverage.
Verdict: APPROVE
Reasoning: The refresh stays within declared contracts, clears the targeted audit findings and introduces no unexpected dependency changes.
— Rames
Resolve bun.lock by taking main's lock and re-applying the same targeted bun update refreshes (7-day minimum release age). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at d9a8d8af4d91d6d82f94529882fbd456829667d9. No blockers found in the merge resolution.
Verified this is a signed merge of the previously reviewed 4ac4e26c and main 7603215f. Against that main parent, only bun.lock changes: all 18 refreshed package records—including dependency maps and integrity hashes—exactly match 4ac4e26c. Workspace declarations/settings and every unrelated main record are preserved. The two removals are the now-unused @protobufjs/inquire and redundant @google/genai/ws; consumers share patched ws@8.22.1. No new major-version moves or downgrades in the refresh. An override-aware scan of 1,734 dependency/optional/workspace edges found no range violations.
Validation at this head: bun install --frozen-lockfile --ignore-scripts installed 1,470 packages; bun run build exits 0. The gated dependency smoke probe reports protobuf codec, source-map roundtrip, YAML, brace expansion, WebSocket echo: 5 PASS. bun audit --json reports 99→59 advisories against the exact main parent, with no new advisory IDs (the author's 93 baseline did not reproduce). Hosted checks show 84 successful, 49 skipped and one cancelled; no failed or pending jobs. The earlier full compatibility review still applies to the identical refreshed package records; the merged main code was checked for preservation rather than independently re-reviewed in full.
Need: yes, patched transitive resolutions · Size: ok · Reuse: existing dependency ranges and main overrides · Simpler: already minimal · Structure: fine (checked both parent graphs and unchanged workspace declarations; no split)
Risk: low — same reviewed transitive refresh, preserving main's newer dependencies.
Verdict: APPROVE.
Reasoning: The merge keeps both main's dependency updates and the previously reviewed security refresh, with no unexpected lockfile resolution changes.
— Rames
What
Lockfile-only refresh of vulnerable transitive resolutions in the root
bun.lock. Nopackage.jsonchanges and no newoverrides; every new version already satisfies its parents' existing ranges.Adjacent resolver changes these unavoidably drag in:
@protobufjs/fetch1.1.0 → 1.1.1 and@protobufjs/eventemitter1.1.0 → 1.1.1 (protobufjs 7.6.x floors).@protobufjs/inquiredrops out because fetch 1.1.1 no longer depends on it.hasown2.0.3 → 2.0.4 (form-data 2.5.6 requires^2.0.4; kept deduped to one copy).caniuse-lite,electron-to-chromium,node-releases,update-browserslist-db: browser data packages, raised to browserslist 4.29's floors.@google/genai/ws@8.20.0entry dedupes into the hoistedws@8.22.1.Why
Clears these published advisories (34 entries in
bun audit, 93 → 59 total against currentmain):bun auditshows none of these packages after the change.Related work
No open Renovate PR covers these transitives. Merged
main(after #7641, #7652, #7653) into this branch;bun.lockwas resolved by taking main's lock and re-running the same targeted updates, giving the same resulting entries as before.How
bun update <pkg>per package, with a temporary, uncommittedbunfig.tomlminimumReleaseAgeof 7 days so no newly resolved version is younger than a week (newest:caniuse-lite/electron-to-chromium, 2026-11-06). Bun 1.4.4 perengines.bun.bun update hasownto keep a singlehasowncopy.versionchurn bun writes into the workspaces block.ws@8.22.2and contain none of the other packages;packages/studio/frontend/bun.lockcontains none of them. No other locks need changes.Test plan
bun install --frozen-lockfileaccepts the lock ("no changes")bun whyfor each changed package shows the new version as the only resolutionbun auditbefore/after: the 34 advisories above cleared, none newbun run lint,bun run format:check— Clippy
🤖 Generated with Claude Code