build(deps): bump the npm_and_yarn group across 2 directories with 9 updates#2
build(deps): bump the npm_and_yarn group across 2 directories with 9 updates#2dependabot[bot] wants to merge 1 commit into
Conversation
…updates Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [file-type](https://github.com/sindresorhus/file-type) | `21.3.1` | `21.3.2` | | [hono](https://github.com/honojs/hono) | `4.12.7` | `4.12.18` | | [undici](https://github.com/nodejs/undici) | `7.22.0` | `7.24.0` | | [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.3` | `8.0.5` | Bumps the npm_and_yarn group with 2 updates in the /ui directory: [dompurify](https://github.com/cure53/DOMPurify) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `file-type` from 21.3.1 to 21.3.2 - [Release notes](https://github.com/sindresorhus/file-type/releases) - [Commits](sindresorhus/file-type@v21.3.1...v21.3.2) Updates `hono` from 4.12.7 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.18) Updates `undici` from 7.22.0 to 7.24.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.22.0...v7.24.0) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) Updates `dompurify` from 3.3.3 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.0) Updates `vite` from 8.0.3 to 8.0.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite) Updates `@opentelemetry/exporter-prometheus` from 0.214.0 to 0.217.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.217.0) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `postcss` from 8.5.6 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.14) Updates `dompurify` from 3.3.3 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.0) Updates `vite` from 8.0.3 to 8.0.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite) --- updated-dependencies: - dependency-name: file-type dependency-version: 21.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@opentelemetry/exporter-prometheus" dependency-version: 0.217.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.5 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Request Changes
This PR updates several dependencies but intentionally downgrades undici in the zalo extension, reintroducing critical security vulnerabilities. Additionally, the @opentelemetry/sdk-node bump may introduce breaking changes that risk telemetry reliability.
🌟 Strengths
- Upgrades to hono, file-type, dompurify, and vite contain essential security fixes.
| Priority | File | Category | Impact Summary (≤12 words) | Anchors |
|---|---|---|---|---|
| P1 | extensions/zalo/package.json | Security | Downgrade reintroduces 6 CVEs | path:pnpm-lock.yaml |
| P1 | diagnostics-otel/package.json | Architecture | Breaking changes risk telemetry | path:extensions/.../diagnostics-otel/package.json |
| P1 | package.json | Security | Fixes JWT, cache, JSX injection | |
| P1 | package.json | Security | Fixes ZIP bomb vulnerability | |
| P1 | ui/package.json | Security | Fixes XSS and path traversal |
🔍 Notable Themes
- The undici downgrade is a critical regression that must be reverted before merging.
- The OpenTelemetry SDK bump requires manual verification to ensure no breaking changes affect telemetry export.
📈 Risk Diagram
This diagram illustrates the risk of downgrading undici, which reintroduces six patched CVEs.
sequenceDiagram
participant Dev as Developer
participant Pkg as package.json
participant Zalo as Zalo Extension
participant Und as Undici
Dev->>Pkg: Change undici from 7.24.6 to 7.24.0
Pkg->>Zalo: Dependency resolved to 7.24.0
note over Und: R1(P1): Downgrade reintroduces 6 CVEs (CVE-2026-1525, 1526, 1527, 1528, 2229, 2581)
💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
| "dependencies": { | ||
| "undici": "7.24.6" | ||
| "undici": "7.24.0" | ||
| }, |
There was a problem hiding this comment.
P1 | Confidence: High
This PR intentionally downgrades undici from 7.24.6 to 7.24.0 in the zalo extension. According to the release notes in the PR description, version 7.24.0 patched six CVEs (CVE-2026-1525, 1526, 1527, 1528, 2229, 2581). However, 7.24.6 likely includes additional fixes beyond those. Downgrading reintroduces vulnerabilities fixed in later patches. The pnpm-lock.yaml confirms the lockfile resolves to 7.24.0 instead of 7.24.6. This violates the principle of always moving forward with security patches. Given the project uses undici for HTTP networking (likely AI API calls), this downgrade exposes the application to exploits such as request smuggling, WebSocket crashes, DoS, and CRLF injection—all with High or Medium CVSS scores. The change is not a transient dependency conflict (it is a direct dependency), so it appears deliberate but risky.
| "dependencies": { | |
| "undici": "7.24.6" | |
| "undici": "7.24.0" | |
| }, | |
| "dependencies": { | |
| - "undici": "7.24.6" | |
| + "undici": "7.24.6" | |
| }, |
Evidence: path:pnpm-lock.yaml
| "file-type": "^21.3.1", | ||
| "grammy": "^1.41.1", | ||
| "hono": "4.12.7", | ||
| "hono": "4.12.18", |
There was a problem hiding this comment.
P1 | Confidence: High
This PR updates the hono override from 4.12.7 to 4.12.18. The release notes confirm this version includes security fixes for JWT verification (CVE, bypass of exp/nbf/iat), JSX CSS injection, and cache-middleware authorization bypass. Given the project aggregates AI models (likely involving user-specific tokens or session data), these fixes directly mitigate realistic attack vectors. The bump is safe because it stays within the same major version (4.x) and the overrides ensure consistent versioning across workspaces. No API-breaking changes are listed for this minor range. This is a strong positive change; no negative action required.
| "request": "npm:@cypress/request@3.0.10", | ||
| "request-promise": "npm:@cypress/request-promise@5.0.0", | ||
| "file-type": "21.3.1", | ||
| "file-type": "21.3.2", |
There was a problem hiding this comment.
P1 | Confidence: High
Updating file-type from 21.3.1 to 21.3.2 fixes a ZIP bomb vulnerability in known-size ZIP probing (GHSA-j47w-4g3g-c36v) and a bound recursive BOM/ID3 detection issue. Since file-type is likely used to validate uploaded files (especially relevant to file-sharing AI interactions), this prevents denial-of-service via archive bombs. No breaking changes reported. Neutral change; no further action needed.
| "@create-markdown/preview": "^2.0.0", | ||
| "@noble/ed25519": "3.0.1", | ||
| "dompurify": "^3.3.3", | ||
| "dompurify": "^3.4.0", |
There was a problem hiding this comment.
P1 | Confidence: High
Bumping dompurify from 3.3.3 to 3.4.0 in the UI package (and likely transitively via the override) includes the latest security fixes against HTML sanitization bypasses. Given the UI uses DOMPurify to sanitize Markdown-rendered content (likely AI responses), this is critical to prevent stored XSS. The same positive applies to the Vite devDependency bump (8.0.3 to 8.0.5) which fixes path traversal and sourcemap file access issues in development server. These are safe, necessary upgrades.
| "@opentelemetry/sdk-logs": "^0.214.0", | ||
| "@opentelemetry/sdk-metrics": "^2.6.1", | ||
| "@opentelemetry/sdk-node": "^0.214.0", | ||
| "@opentelemetry/sdk-node": "^0.217.0", |
There was a problem hiding this comment.
P1 | Confidence: Medium
Both diagnostics-otel/package.json and extensions/diagnostics-otel/package.json bump @opentelemetry/sdk-node from ^0.214.0 to ^0.217.0. This is a span of three minor versions in a pre-1.0 package, which frequently includes breaking behavioral changes (e.g., changes to startNodeSDK() configuration handling, log level semantics, and the OTLP transformer rewrite noted in release notes). The PR description mentions breaking changes in v0.215.0 and v0.217.0. The related context search did not find direct usage of SDK functions, so we cannot guarantee backward compat. A silent behavior change could break telemetry export without immediate test failure. Given the observability-critical role, this poses a risk to production monitoring. The maintainer should validate compatibility by reviewing changelogs and running integration tests before merging.
|
Superseded by #3. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/npm_and_yarn-3afeaedf3a
branch
Bumps the npm_and_yarn group with 6 updates in the / directory:
21.3.121.3.24.12.74.12.187.22.07.24.02.8.22.8.33.3.33.4.08.0.38.0.5Bumps the npm_and_yarn group with 2 updates in the /ui directory: dompurify and vite.
Updates
file-typefrom 21.3.1 to 21.3.2Release notes
Sourced from file-type's releases.
Commits
e18028c21.3.2a155cd7Fix ZIP bomb in known-size ZIP probing6954817Harden parser more370ed91Fix bound recursive BOM and ID3 detectiond2ecea1Add a few more safeguards41fcff5Update readmea8f6934Fix CIUpdates
honofrom 4.12.7 to 4.12.18Release notes
Sourced from hono's releases.
... (truncated)
Commits
f10dee84.12.18a5bd9ebMerge commit from fork58d3d3aMerge commit from fork568c2ecMerge commit from forkff2b3d34.12.1752aaaf9fix(types): propagate middleware response types to app.on overloads (#4906)76d5589fix(cors): make origin optional in CORSOptions (#4905)8f027e5fix(ssg): addatom+xmlandrss+xmltodefaultExtensionMap(#4899)bfba97cfix(jsx): normalize SVG attributes on the <svg> root element (#4893)90d41824.12.16Updates
undicifrom 7.22.0 to 7.24.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
07a3906Bumped v7.24.0 (#4887)74495c6fix: reject duplicate content-length and host headers84235c6Fix websocket 64-bit length overflow77594f9fix: validate upgrade header to prevent CRLF injectioncb79c57fix: validate server_max_window_bits range in permessage-deflate4147ce2Merge commit '2ee00cb3'2ee00cbfix(websocket): add maxDecompressedMessageSize limit for permessage-deflate5890c7bfix(deduplicate): stream response chunks to waiting handlersfbda3c1Bumped v7.23.0 (#4884)07276c9fix: remove unused kSocketPath symbolUpdates
yamlfrom 2.8.2 to 2.8.3Release notes
Sourced from yaml's releases.
Commits
ce145872.8.31e84ebbfix: Catch stack overflow during node composition6b24090ci: Include Prettier check in lint action9424deechore: Refresh lockfiled1aca82Add trailingComma ToString option for multiline flow formatting (#670)4321509ci: Drop the branch filter from GitHub PR actions47207d0chore: Update docs-slate5212faechore: Update docs-slateUpdates
dompurifyfrom 3.3.3 to 3.4.0Release notes
Sourced from dompurify's releases.
Commits
5b16e0bGetting 3.x branch ready for 3.4.0 release (#1250)Updates
vitefrom 8.0.3 to 8.0.5Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
1a12d4crelease: v8.0.579f002ffix: avoid path traversal with optimize deps sourcemap handler (#22161)a9a3df2fix: checkserver.fsafter stripping query as well (#22160)f02d9fdfix: apply server.fs check to env transport (#22159)f05f501fix: disallow referencing files outside the package from sourcemap (#22158)7339bdcrelease: v8.0.454229e7docs: addenvironment.fetchModuledocumentation (#22035)b0da973feat: allow esbuild 0.28 as peer deps (#22155)22b0166fix(deps): update all non-major dependencies (#22143)17330d2fix: add types forvite/modulepreload-polyfill(#22126)Updates
@opentelemetry/exporter-prometheusfrom 0.214.0 to 0.217.0Release notes
Sourced from @opentelemetry/exporter-prometheus's releases.
... (truncated)
Commits
74cde1bchore: prepare next release (#6675)e8f439afix: handle malformed URLs in Prometheus exporter request handler (#6674)ab3a2e2feat(sdk-node, configuration): diag log handling updates for startNodeSDK(), ...d5b7d1efix(deps): update dependency axios to v1.15.2 [security] (#6670)c163618chore(deps): update github/codeql-action digest to e46ed2c (#6661)ec2bfbechore(configuration): move config generation scripts into the configuration p...acc9ecdchore(configuration): cosmetic changes to generated types.ts (#6663)8f008ecchore: Move inactive members to emeritus (#6649)435431efix(configuration): improve the technique for removing '| null' on types due ...4222024fix(configuration): improve handling of enums in generated types (#6659)Updates
picomatchfrom 2.3.1 to 2.3.2Release notes
Sourced from picomatch's releases.
Changelog
Sourced from picomatch's changelog.
... (truncated)
Commits
81cba8dPublish 2.3.2fc1f6b6Merge commit from forkeec17aeMerge commit from fork78f8ca4Merge pull request #156 from micromatch/backport-1443f4f10eMerge pull request #144 from Jason3S/jdent-object-propertiesUpdates
postcssfrom 8.5.6 to 8.5.14Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
3ec1394Release 8.5.14 versionf2bb827Update dependenciesd75953dMerge pull request #2084 from 43081j/raw-raws-rawing68bd213fix: always callrawto retrieve raw valuesaf58cf1Release 8.5.13 versionf227dbdTemporary ignore pnpm 11 configd3abd40Update dependenciesdd06c3eRevert stringifier changes because of the conflict with postcss-scssae889c8Try to fix CIe0093e4Move to pnpm 11Updates
dompurifyfrom 3.3.3 to 3.4.0Release notes
Sourced from dompurify's releases.
Commits
5b16e0bGetting 3.x branch ready for 3.4.0 release (#1250)Updates
vitefrom 8.0.3 to 8.0.5Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
1a12d4crelease: v8.0.579f002ffix: avoid path traversal with optimize deps sourcemap handler (#22161)a9a3df2fix: checkserver.fsafter stripping query as well (#22160)f02d9fdfix: apply server.fs check to env transport (#22159)f05f501fix: disallow referencing files outside the package from sourcemap (#22158)7339bdcrelease: v8.0.454229e7docs: addenvironment.fetchModuledocumentation (#22035)b0da973feat: allow esbuild 0.28 as peer deps (#22155)22b0166fix(deps): update all non-major dependencies (#22143)17330d2fix: add types forvite/modulepreload-polyfill(#22126)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.