Skip to content

fix(deps): resolve security advisories and update hash-runner #468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
theogravity merged 3 commits into from
Oct 29, 2026
Merged

fix(deps): resolve security advisories and update hash-runner #468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c30c10c
fix(deps): resolve Seroval security advisories
theogravity Oct 29, 2026
5e389d6
fix(deps): replace Forge backport with patched release
theogravity Oct 29, 2026
879fc8b
chore(deps): update hash-runner and remove glob override
theogravity Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .changeset/tidy-seroval-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
"@internal/server": patch
"@internal/desktop-server": patch
---

Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities.
2 changes: 1 addition & 1 deletion apps/node/agent/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
"devDependencies": {
"@internal/tsconfig": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
}
Expand Down
132 changes: 31 additions & 101 deletions bun.lock
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 0 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,6 @@
},
"engineStrict": true,
"overrides": {
"hash-runner>glob": "11.1.0",
"xcode>uuid": "11.1.1",
"decode-uri-component": "0.5.0",
"image-size": "2.0.4",
Expand All @@ -106,7 +105,6 @@
"query-string@7.1.3": "patches/query-string@7.1.3.patch",
"metro@0.87.0": "patches/metro@0.87.0.patch",
"@novnc/novnc@1.7.0": "patches/@novnc%2Fnovnc@1.7.0.patch",
"node-forge@1.4.0": "patches/node-forge@1.4.0.patch",
"deepmerge@4.3.1": "patches/deepmerge@4.3.1.patch"
},
"workspaces": [
Expand Down
7 changes: 7 additions & 0 deletions packages/assistant/.hash-runnerrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{
"inputs": {
"includes": ["src/**", "package.json"]
},
"execOnChange": "bun run build",
"hashFile": ".hashes.json"
}
2 changes: 1 addition & 1 deletion packages/assistant/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
"@types/bun": "1.3.14",
"@types/react": "19.2.18",
"@types/react-dom": "19.2.4",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14"
}
}
2 changes: 1 addition & 1 deletion packages/backend-client/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"devDependencies": {
"@internal/server": "workspace:*",
"@internal/tsconfig": "workspace:*",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14"
}
}
2 changes: 1 addition & 1 deletion packages/backend-errors/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"@types/sprintf-js": "1.1.4",
"@internal/tsconfig": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14"
}
}
2 changes: 1 addition & 1 deletion packages/mcp-core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"devDependencies": {
"@internal/tsconfig": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14"
}
}
2 changes: 1 addition & 1 deletion packages/node-admin/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
"@types/bun": "1.3.14",
"@types/react": "19.2.18",
"@types/react-dom": "19.2.4",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"react": "19.2.8",
"react-dom": "19.2.8",
"tsdown": "0.22.14",
Expand Down
2 changes: 1 addition & 1 deletion packages/pane-runtime/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@
"devDependencies": {
"@internal/tsconfig": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
}
Expand Down
2 changes: 1 addition & 1 deletion packages/plugin-api/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
"devDependencies": {
"@internal/tsconfig": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/claude-code/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/cloudflare-tunnel/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/codex/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
7 changes: 7 additions & 0 deletions packages/plugins/grok-build/.hash-runnerrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{
"inputs": {
"includes": ["src/**", "package.json"]
},
"execOnChange": "bun run build",
"hashFile": ".hashes.json"
}
2 changes: 1 addition & 1 deletion packages/plugins/grok-build/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/headscale/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/hermes/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/netbird/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
7 changes: 7 additions & 0 deletions packages/plugins/oh-my-pi/.hash-runnerrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{
"inputs": {
"includes": ["src/**", "package.json"]
},
"execOnChange": "bun run build",
"hashFile": ".hashes.json"
}
2 changes: 1 addition & 1 deletion packages/plugins/oh-my-pi/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/opencode/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/pi/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/ssh/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/tailscale/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/plugins/terminal/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@
"@internal/tsconfig": "workspace:*",
"@subshell-ai/plugin-api": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14",
"typescript": "7.0.2"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/subshell-protocol/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
"@types/sprintf-js": "1.1.4",
"@internal/tsconfig": "workspace:*",
"@types/bun": "1.3.14",
"hash-runner": "4.0.0",
"hash-runner": "5.0.0",
"tsdown": "0.22.14"
}
}
21 changes: 0 additions & 21 deletions patches/node-forge@1.4.0.patch
View file
Open in desktop

This file was deleted.

9 changes: 1 addition & 8 deletions scripts/dep-audit.ignore.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,9 @@
[
{
"package": "node-forge",
"advisories": [
"GHSA-86w9-cpqp-85rv"
],
"reason": "Expo mobile build/dev tooling only. node-forge 1.4.0 has no published fixed release (checked 2026-10-25). patches/node-forge@1.4.0.patch backports the nested DigestAlgorithm element-count check proposed in https://github.com/digitalbazaar/forge/pull/1152. scripts/__tests__/dependency-security.test.ts checks the installed copies used by Expo CLI and code-signing-certificates: malformed signatures are rejected while valid signatures and certificates work. bun audit still matches the original version; replace the patch and remove this exception when a fixed release ships."
},
{
"package": "deepmerge",
"advisories": [
"GHSA-gcqx-w48m-w2h4"
],
"reason": "Expo configuration build/dev tooling. deepmerge 4.3.1 has no published fixed release (checked 2026-10-27). patches/deepmerge@4.3.1.patch blocks __proto__ in both target and source copy loops, including both distributed bundles. scripts/__tests__/fixtures/deepmerge-consumers.cjs exercises the installed Expo consumer under Node, reproducing null-prototype, nested-placeholder and target-copy poisoning while verifying ordinary configuration merges. The regression fails without the patch. bun audit matches the original version; remove this patch and exception when a fixed release ships."
"reason": "Expo configuration build/dev tooling. deepmerge 4.3.1 has no published fixed release (checked 2026-10-28). patches/deepmerge@4.3.1.patch blocks __proto__ in both target and source copy loops, including both distributed bundles. scripts/__tests__/fixtures/deepmerge-consumers.cjs exercises the installed Expo consumer under Node, reproducing null-prototype, nested-placeholder and target-copy poisoning while verifying ordinary configuration merges. The regression fails without the patch. bun audit matches the original version; remove this patch and exception when a fixed release ships."
}
]
Loading