deps: clear 14 pnpm advisories and land the weekly dep groups - #490
Conversation
Folds the three open Dependabot PRs into one change and closes #486. pnpm 11.1.3 -> 11.21.0 across all six files that declare it, eight lines in total (the issue listed four sites; development.md's verify snippet, README.md and AGENTS.md were missed). 11.1.3 sat below the first_patched_version of fourteen advisories in the 11.x line, floor 11.8.0. 11.21.0 over the newer 11.22.0 because the repo's own minimumReleaseAge: 10080 encodes a 7-day cooldown and 11.22.0 is three days old; both clear every advisory. lockfileVersion stays at 9.0. Dependabot's `directory: /` for github-actions reaches .github/workflows/ and does not descend into .github/actions/*/action.yml, so the setup-env composite action -- which owns every cache in CI -- went untracked, so its pins went stale against upstream and diverged from publish-npm.yml, a workflow Dependabot DOES track and which does not call setup-env (actions/setup-node v7.0.0 there vs v6.4.0 here; pnpm/action-setup v6.0.9 vs v6.0.8). actions/cache was uniformly v5.0.5 everywhere, simply a major behind upstream. The config moves to `directories: [/, /.github/actions/setup-env]` and the action is brought up to the versions #480 proposed for the workflows. Groups landed: actions-deps (#480) verbatim, go-deps (#481) verbatim, and four of the five npm-deps bumps (#482). typescript 6 -> 7 is held: tsup 8.5.1 vendors rollup-plugin-dts 6.1.1, which reaches for TS 5-era compiler internals and throws on `dts: true` inside clients/ts's prepare script -- i.e. inside pnpm install, taking every Node job down at once. rollup-plugin-dts >= 6.5.0 declares TS 7 support, so the unblock is a tsup release that vendors it; dependabot.yml ignores the typescript major until then. Also makes housekeeping.yml's documented "labeling failures are non-fatal" contract true -- the labeler step never carried continue-on-error, which is why a transient GitHub 500 reddened #481. Closes #486. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YEwX2gCkH2BSzEfX6bUvDV
github-actions
Bot
added
documentation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (16)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (3)
🧰 Additional context used📓 Path-based instructions (4)**/*📄 CodeRabbit inference engine (AGENTS.md)
Files:
.github/workflows/*.yml📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.md📄 CodeRabbit inference engine (AGENTS.md)
Files:
docs/src/content/docs/**/*.md📄 CodeRabbit inference engine (AGENTS.md)
Files:
🧠 Learnings (5)📚 Learning: 2026-08-11T11:20:19.556ZApplied to files:
📚 Learning: 2026-06-10T15:01:09.027ZApplied to files:
📚 Learning: 2026-08-18T19:25:33.501ZApplied to files:
📚 Learning: 2026-06-10T15:01:59.729ZApplied to files:
📚 Learning: 2026-08-11T12:41:05.990ZApplied to files:
🪛 LanguageTooldocs/src/content/docs/development.md[uncategorized] ~559-~559: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~559-~559: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~564-~564: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~564-~564: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~566-~566: The official name of this software platform is spelled with a capital “H”. (GITHUB) CHANGELOG.md[uncategorized] ~32-~32: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~32-~32: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~32-~32: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~32-~32: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~32-~32: The official name of this software platform is spelled with a capital “H”. (GITHUB) [typographical] ~32-~32: In American English, use a period after an abbreviation. (MISSING_PERIOD_AFTER_ABBREVIATION) [typographical] ~32-~32: In American English, use a period after an abbreviation. (MISSING_PERIOD_AFTER_ABBREVIATION) [style] ~32-~32: Since ownership is already implied, this phrasing may be redundant. (PRP_OWN) [uncategorized] ~32-~32: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~60-~60: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~60-~60: The official name of this software platform is spelled with a capital “H”. (GITHUB) 🪛 OSV Scanner (2.4.0)go.mod[LOW] 196-196: golang.org/x/crypto 0.55.0: The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues (GO-2026-5932) [LOW] 198-198: golang.org/x/image 0.41.0: Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image (GO-2026-4961) [LOW] 198-198: golang.org/x/image 0.41.0: Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image (GO-2026-5061) [LOW] 198-198: golang.org/x/image 0.41.0: Lack of limit on tile sizes in x/image/tiff in golang.org/x/image (GO-2026-5062) [LOW] 198-198: golang.org/x/image 0.41.0: Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image (GO-2026-5066) [LOW] 198-198: golang.org/x/image 0.41.0: Excessive memory allocation during VP8L decoding in golang.org/x/image (GO-2026-6222) [LOW] 199-199: golang.org/x/mod 0.38.0: Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog (GO-2026-6179) [LOW] 199-199: golang.org/x/mod 0.38.0: Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb (GO-2026-6180) 🪛 zizmor (1.29.0).github/workflows/publish-dev.yml[error] 77-77: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default (cache-poisoning) 🔇 Additional comments (17)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR updates pnpm to 11.21.0, refreshes Go and npm dependencies, updates Dependabot coverage, and upgrades pinned GitHub Actions across CI, publishing, and release workflows. ChangesDependency and workflow maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This dependency update is merge-ready after normal checks and review; no actionable merge-blocking risk remains. Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
📚 Docs preview is live → https://332cab50-wavehouse-docs.wave-rf.workers.dev
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
#490 landed a better fix for the Dependabot composite-action gap than mine, so main's version wins on every shared file: - .github/dependabot.yml: taken wholesale. My two `updates:` entries are two independent Dependabot jobs and a group is scoped to its own job, so they would emit two actions-deps PRs every Monday -- the noise the group comment exists to prevent. main's `directories: [/, ...]` is one job, one PR. main's comment also carries the accuracy fix: actions/cache was uniformly v5.0.5 at every site, a major behind upstream rather than behind a caller. - .github/actions/setup-env/action.yml: taken wholesale. My bumps were a strict subset and stale (cache still v5.0.5, pnpm 11.1.3). - development.md Dependabot section: taken wholesale. My "four update configs" auto-merged silently and is wrong under the directories form -- it is three. main's also documents the typescript major hold (#487). - My CHANGELOG entry describing the two-entry mechanism is dropped; #490's entry on main is the accurate record of the same fix. Kept mine, reconciled by hand: - README's `--signer-workflow` fix -- #490 deliberately avoided it. - persist-credentials: false across the four release workflows. - clients/ts/README.md and sdk/index.mdx: #470 changed streaming from EventSource to fetch. Took its wording, kept my `latest`-is-a-dev- snapshot caveat and the corrected anchor -- main still links #releasing-the-sdk, a section this branch renamed. - CHANGELOG resolved with the same script as the #479 merge: main's entry text into this branch's structure. Verified 331 main entries + 29 branch entries, none lost, none invented, no duplicates. All action pins now match main exactly; no stale pnpm strings remain. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015bVwHtNakQgmnBhMcfW8pe
Both stale against what actually ships, found by the pre-push gate. - "Aligned setup-env's action pins" recorded pnpm/action-setup v6.0.8 -> v6.0.9. The merge took main's setup-env wholesale, so the file is now byte-identical to origin/main and carries v6.0.10 -- my entry recorded a state no commit in this release ever produced, and #490's entry immediately below it already covers the same file's same pins with the numbers that shipped. Same reasoning the merge gave for dropping its sibling. - "The SDK release checkout persisted git credentials" was subsumed by the sweep entry two lines above, which even narrates its origin. It still ended "matching ci.yml" -- verbatim the implication f29dd54 was written to remove, and contradicted by the sweep entry now naming housekeeping.yml as also already compliant. A reader also counted two credential incidents where there was one. Its two unique details (the npm-lifecycle threat model, the CodeRabbit attribution) are folded up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015bVwHtNakQgmnBhMcfW8pe
1 participant
Folds the three open Dependabot PRs into one reviewable change, fixes the
pnpm advisories from #486, and repairs the Dependabot config gap that let the
setup-envcomposite action drift out of sync in the first place.Closes #486. Supersedes #480, #481, #482.
Why one PR instead of merging the three
They are not independent:
publish-npm.ymland.github/actions/setup-env/action.yml; ci: bump the actions-deps group with 7 updates #480 bumpsaction SHAs in the same two files. Sequencing them costs a rebase either way.
.github/workflows/— see below — so ci: bump the actions-deps group with 7 updates #480 moves the workflows toactions/cachev6.1.0 whilesetup-env, which owns every cache in CI,stays on v5.0.5. Only a hand-written commit can close that.
blocked upstream, permanently for now — see below.
go.mod/go.sum, all patch/minor).One CI run, one review, no interleaving.
1. pnpm 11.1.3 → 11.21.0 (#486)
Eight declaration lines across six files, not the four sites the issue listed:
package.jsonpackageManager.github/workflows/publish-npm.yml.github/actions/setup-env/action.ymldocs/src/content/docs/development.mdcorepack prepareline, prerequisites table, and the "verify your setup" snippetREADME.mdpnpm 11+floor in Local DevelopmentAGENTS.mdpnpm (≥ 11.1)floor in the toolchain listThe issue's advisory table is off by four. #486 lists ten; the actual
count affecting 11.1.3 is fourteen — 8 high, 6 medium. Its table
includes GHSA-v23m-ccfg-pq9h,
whose range is
>= 11.3.0, < 11.5.3and so does not cover 11.1.3, andomits five that do: GHSA-hwx4-2j3j-g496 (high), GHSA-cjhr-43r9-cfmw,
GHSA-p4xf-rf54-rj3x, GHSA-q6j5-fjx5-2mc3 and GHSA-54hh-g5mx-jqcp. "Eight
high" happens to survive only because the wrongly-included high and the
omitted high cancel out. All five were published 2026-06-26, so this was a
counting slip when the issue was written, not new information.
The remediation is unchanged — the highest
first_patched_versionis still11.8.0, and 11.21.0 clears all fourteen. Worth correcting the table on
#486 so the issue and this PR agree.
Why 11.21.0 and not 11.22.0 (latest). 11.22.0 shipped 2026-08-15, three
days ago.
pnpm-workspace.yamlsetsminimumReleaseAge: 10080— adeliberate 7-day cooldown against compromised releases. That knob governs
dependency resolution, not the
packageManagerpin, but the reasoningapplies harder here: pnpm runs postinstall scripts under
allowBuilds:inevery CI job, and in
publish-npm.yml, which holdsid-token: writefornpm trusted publishing. 11.21.0 is 9 days old and equally clear of every
advisory. Say the word and I'll move it to 11.22.0.
lockfileVersionis unchanged at9.0. The issue flagged a possiblebump; 11.21.0 reads and writes the existing format, and
pnpm install --frozen-lockfilepassed against the pre-existing lockfilebefore it was regenerated.
2. Dependabot never scanned the composite action
directory: /forpackage-ecosystem: github-actionsreaches.github/workflows/and stops. It does not descend into.github/actions/*/action.yml.setup-envhas been invisible to Dependabotsince it was created. Its only caller is
ci.yml, which pins none of theseactions itself — they all live inside
setup-env— so the staleness showsup against upstream, and against
publish-npm.yml, a workflow Dependabotdoes track and which does not call
setup-env:setup-envonmainmainactions/setup-nodepublish-npm.ymlpnpm/action-setuppublish-npm.ymlactions/cache(×6)The
setup-noderow is the tell: that major landed inpublish-npm.ymlinan earlier Dependabot PR and
setup-env, being invisible, never followed.(#480 would then have introduced a cache skew, bumping
publish-dev.ymlto v6.1.0 while
setup-envstayed on v5.0.5.)This PR aligns all three to the versions the workflows already use — no
version is introduced here that Dependabot has not already proposed and CI
has not already run — and switches the config to
directories: [/, /.github/actions/setup-env]so the group covers it from now on.
3. actions-deps (#480), verbatim
upload-code-coverage1.4.1→1.4.2 ·labeler6.2.0→7.0.0 ·cache+cache/restore5.0.5→6.1.0 ·docker/login-action4.4.0→4.6.0 ·
attest-build-provenance4.1.1→4.2.2 ·pnpm/action-setup6.0.9→6.0.10.
Both majors are ESM migrations with no config surface change, and #480's own
CI run was fully green on them.
4. go-deps (#481), verbatim
nats-server2.14.4→2.14.5 ·nats.go1.52.0→1.53.1 ·testify1.11.1→1.12.0 ·
testcontainers-go0.43.0→0.44.0, plus indirects. Allpatch/minor. #481's only red check was
PR housekeepingfailing on atransient GitHub API 500 inside
actions/labeler— not a code problem, andnow not a red check either (see below).
5. npm-deps (#482), minus TypeScript 7
Taken:
tsx4.23.5→4.23.12 ·@astrojs/starlight0.41.6→0.41.7 ·katex0.18.1→0.18.4 ·
@types/nodecatalog ^26.1.2→^26.2.0.Held:
typescript^6.0.3 → ^7.0.2. This is why every Node job on #482went red. Reproduced locally:
tsup8.5.1 — the current release — vendorsrollup-plugin-dts6.1.1into its own bundle, so it is not overridable from our side. 6.1.1 reaches
for TS 5-era compiler internals and dies the moment
dts: trueruns. Thatis
clients/ts'spreparescript, so the crash happens insidepnpm installand takes down Lint, Unit, E2E, Coverage and Docs build atonce.
rollup-plugin-dts6.5.0 is the first release declaringtypescript: "^4.5 || ^5 || ^6 || ^7"(6.4.0 stops at^6.0); we need atsuprelease that vendors ≥ 6.5.0.No rebase of #482 can fix this, and left alone Dependabot re-proposes it
every Monday — so
.github/dependabot.ymlnow ignoresversion-update:semver-majorfortypescript, with the reason and theremoval condition written next to it.
The regenerated lockfile changes exactly four resolved packages and adds
or drops none:
6. One-line fix: labeling really is non-fatal now
housekeeping.yml's header has always claimed:It wasn't true — the
Apply file-path labelsstep has never carriedcontinue-on-error, in any revision. So when the labeler hit a transient500 on #481:
the job aborted before the title mirror it exists to protect, and the check
went red. Adding
continue-on-error: truemakes the documented contract real.In scope because it is the direct cause of one of the three red PRs this
change set is meant to clear.
PR housekeepingis not a required check — theCIaggregator is — so this was noise rather than a merge blocker, but it'snoise that costs a re-run every time GitHub hiccups.
What this PR's CI does not prove
Worth stating rather than implying green means everything:
actions/labeler6.2.0 → 7.0.0 is not exercised here.housekeeping.ymlruns on
pull_request_target, so GitHub loads that workflow file frommain, not from the PR head. ThePR housekeepingcheck on this PR — andon ci: bump the actions-deps group with 7 updates #480 — runs labeler v6.2.0 regardless. v7.0.0 first executes on the
PR after this merges. Mitigating: v7.0.0 is an ESM-migration-only release,
.github/labeler.ymlalready uses the v5+changed-filesschema, and thelabeling step is deliberately
continue-on-errorso a bad labeler cannotblock a PR.
publish-npm.yml,publish-dev.ymlandrelease.ymlare tag/releasetriggered, so their action bumps (and the new pnpm pin in the publish
jobs) first run on the next release, not here.
actions/cache5.0.5 → 6.1.0 is covered —ci.ymlruns onpull_request, so every cache insetup-envexercises v6.1.0 on this PR.Verification
make cigreen locally with Docker up, running on pnpm 11.21.0 — allstatic checks, unit, integration, E2E and every coverage gate.
pnpm install --frozen-lockfileclean against the regenerated lockfile;tsupDTS build succeeds..github/any more (was:
cache,setup-node,pnpm/action-setup).actionlint,shellcheck,biomeandmarkdownlintall pass over theworkflow, config and CHANGELOG edits.
CHANGELOG.mdupdated under[Unreleased]— a Security entry for the pnpmbump and a Changed entry for the groups + Dependabot config.
gh api "/advisories?ecosystem=npm&affects=pnpm" --paginatewith range matching against 11.1.3, not copied from the issue.Note that #480/#481/#482 are superseded rather than closed by me — Dependabot
should retire them on its next run once these versions are on
main.