Skip to content

build(deps): bump the npm_and_yarn group across 2 directories with 9 updates #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): bump the npm_and_yarn group across 2 directories with 9 updates #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion diagnostics-otel/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"@opentelemetry/resources": "^2.6.1",
"@opentelemetry/sdk-logs": "^0.214.0",
"@opentelemetry/sdk-metrics": "^2.6.1",
"@opentelemetry/sdk-node": "^0.214.0",
"@opentelemetry/sdk-node": "^0.217.0",

@llamapreview llamapreview Bot May 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 | Confidence: Medium

Both diagnostics-otel/package.json and extensions/diagnostics-otel/package.json bump @opentelemetry/sdk-node from ^0.214.0 to ^0.217.0. This is a span of three minor versions in a pre-1.0 package, which frequently includes breaking behavioral changes (e.g., changes to startNodeSDK() configuration handling, log level semantics, and the OTLP transformer rewrite noted in release notes). The PR description mentions breaking changes in v0.215.0 and v0.217.0. The related context search did not find direct usage of SDK functions, so we cannot guarantee backward compat. A silent behavior change could break telemetry export without immediate test failure. Given the observability-critical role, this poses a risk to production monitoring. The maintainer should validate compatibility by reviewing changelogs and running integration tests before merging.

"@opentelemetry/sdk-trace-base": "^2.6.1",
"@opentelemetry/semantic-conventions": "^1.40.0"
},
Expand Down
2 changes: 1 addition & 1 deletion extensions/diagnostics-otel/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
"@opentelemetry/resources": "^2.6.1",
"@opentelemetry/sdk-logs": "^0.214.0",
"@opentelemetry/sdk-metrics": "^2.6.1",
"@opentelemetry/sdk-node": "^0.214.0",
"@opentelemetry/sdk-node": "^0.217.0",
"@opentelemetry/sdk-trace-base": "^2.6.1",
"@opentelemetry/semantic-conventions": "^1.40.0"
},
Expand Down
2 changes: 1 addition & 1 deletion extensions/zalo/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"description": "OpenClaw Zalo channel plugin",
"type": "module",
"dependencies": {
"undici": "7.24.6"
"undici": "7.24.0"
},
Comment on lines 6 to 8

@llamapreview llamapreview Bot May 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 | Confidence: High

This PR intentionally downgrades undici from 7.24.6 to 7.24.0 in the zalo extension. According to the release notes in the PR description, version 7.24.0 patched six CVEs (CVE-2026-1525, 1526, 1527, 1528, 2229, 2581). However, 7.24.6 likely includes additional fixes beyond those. Downgrading reintroduces vulnerabilities fixed in later patches. The pnpm-lock.yaml confirms the lockfile resolves to 7.24.0 instead of 7.24.6. This violates the principle of always moving forward with security patches. Given the project uses undici for HTTP networking (likely AI API calls), this downgrade exposes the application to exploits such as request smuggling, WebSocket crashes, DoS, and CRLF injection—all with High or Medium CVSS scores. The change is not a transient dependency conflict (it is a direct dependency), so it appears deliberate but risky.

Suggested change
"dependencies": {
"undici": "7.24.6"
"undici": "7.24.0"
},
"dependencies": {
- "undici": "7.24.6"
+ "undici": "7.24.6"
},

Evidence: path:pnpm-lock.yaml

"devDependencies": {
"openclaw": "workspace:*"
Expand Down
6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1204,7 +1204,7 @@
"express": "^5.2.1",
"file-type": "^21.3.1",
"grammy": "^1.41.1",
"hono": "4.12.7",
"hono": "4.12.18",

@llamapreview llamapreview Bot May 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 | Confidence: High

This PR updates the hono override from 4.12.7 to 4.12.18. The release notes confirm this version includes security fixes for JWT verification (CVE, bypass of exp/nbf/iat), JSX CSS injection, and cache-middleware authorization bypass. Given the project aggregates AI models (likely involving user-specific tokens or session data), these fixes directly mitigate realistic attack vectors. The bump is safe because it stays within the same major version (4.x) and the overrides ensure consistent versioning across workspaces. No API-breaking changes are listed for this minor range. This is a strong positive change; no negative action required.

"https-proxy-agent": "^8.0.0",
"ipaddr.js": "^2.3.0",
"jiti": "^2.6.1",
Expand Down Expand Up @@ -1261,12 +1261,12 @@
"pnpm": {
"minimumReleaseAge": 2880,
"overrides": {
"hono": "4.12.7",
"hono": "4.12.18",
"@hono/node-server": "1.19.10",
"fast-xml-parser": "5.3.8",
"request": "npm:@cypress/request@3.0.10",
"request-promise": "npm:@cypress/request-promise@5.0.0",
"file-type": "21.3.1",
"file-type": "21.3.2",

@llamapreview llamapreview Bot May 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 | Confidence: High

Updating file-type from 21.3.1 to 21.3.2 fixes a ZIP bomb vulnerability in known-size ZIP probing (GHSA-j47w-4g3g-c36v) and a bound recursive BOM/ID3 detection issue. Since file-type is likely used to validate uploaded files (especially relevant to file-sharing AI interactions), this prevents denial-of-service via archive bombs. No breaking changes reported. Neutral change; no further action needed.

"form-data": "2.5.4",
"minimatch": "10.2.4",
"qs": "6.14.2",
Expand Down
Loading
Loading