From f6bb8cb870c43962e59f3575c7173a5e95f43f6e Mon Sep 17 00:00:00 2001 From: Madraka <8898640+Madraka@users.noreply.github.com> Date: Sun, 8 Nov 2026 02:45:58 +0300 Subject: [PATCH] fix(deps): close the open Dependabot security alerts Dependabot reported 37 open alerts on 2026-11-08, all transitive and all in the lockfiles: - undici 7.28.0 (pinned exactly by miniflare 4.20260730.0, ADR-0012's pin): a pnpm override to 7.30.2, documented in pnpm-workspace.yaml next to the sharp override. Alerts #5-#32 (GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c, GHSA-rfgv-xxqx-mfg5, GHSA-w293-vg96-wgc3, GHSA-4cwx-7wf7-3272 and the medium/low advisories patched in 7.29.0, 7.29.1 and 7.30.1). - undici 8.11.2 (astro -> unifont ^8.0.0): plain update to 8.12.4, alerts #21-#35 on the 8.x line. - seroval 1.6.8 (@tanstack/router-core ^1.6.7): plain update to 1.7.9 with seroval-plugins 1.7.8. Alerts #36 (GHSA-9wx9-5pv9-3349) and #37 (GHSA-f86p-h4j2-7qgj). This one ships in the Studio bundle inside @cloudhal/cli, hence the changeset. - rustls 0.23.45 -> 0.23.46: alerts #1-#4 (GHSA-c8m5-c952-6cm4, GHSA-h2v8-394m-p7vv, GHSA-w44r-93j7-qv28, GHSA-vp88-798v-h67f). cargo audit then reported two more, not surfaced by Dependabot: rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0382) and webpki-root-certs 1.0.9 -> 1.0.11 (RUSTSEC-2026-0383), plus the tokio unsoundness warning RUSTSEC-2026-0386 (1.53.2 -> 1.54.1). pnpm audit and cargo audit are clean. Co-Authored-By: Claude Fable 5.1 Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com> --- .changeset/security-alerts-2026-11.md | 5 +++ Cargo.lock | 20 ++++++------ pnpm-lock.yaml | 45 ++++++++++++++------------- pnpm-workspace.yaml | 6 ++++ 4 files changed, 44 insertions(+), 32 deletions(-) create mode 100644 .changeset/security-alerts-2026-11.md diff --git a/.changeset/security-alerts-2026-11.md b/.changeset/security-alerts-2026-11.md new file mode 100644 index 00000000..f4c065ef --- /dev/null +++ b/.changeset/security-alerts-2026-11.md @@ -0,0 +1,5 @@ +--- +"@cloudhal/cli": patch +--- + +The Studio bundle shipped in `@cloudhal/cli` no longer contains seroval 1.6.8 (a transitive dependency of `@tanstack/react-router`), which GHSA-9wx9-5pv9-3349 and GHSA-f86p-h4j2-7qgj affect: the lockfile now resolves seroval 1.7.9 and seroval-plugins 1.7.8. In the same sweep the monorepo lockfiles move undici to 7.30.2 (an override for the 7.28.0 that Miniflare 4 pins; GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c, GHSA-rfgv-xxqx-mfg5, GHSA-w293-vg96-wgc3, GHSA-4cwx-7wf7-3272 and the medium/low undici 7.x advisories patched in 7.29.0 to 7.30.1) and 8.12.4 (the same advisories on the 8.x line, through astro's unifont), rustls to 0.23.46 (GHSA-c8m5-c952-6cm4, GHSA-h2v8-394m-p7vv, GHSA-w44r-93j7-qv28, GHSA-vp88-798v-h67f), and, found by `cargo audit`, rustls-webpki to 0.103.16 (RUSTSEC-2026-0382), webpki-root-certs to 1.0.11 (RUSTSEC-2026-0383) and tokio to 1.54.1 (RUSTSEC-2026-0386, unsoundness). undici and rustls are development-time dependencies of this repository only; no published package depends on them. diff --git a/Cargo.lock b/Cargo.lock index efb2857c..1887bb7a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1176,9 +1176,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "aws-lc-rs", "once_cell", @@ -1227,7 +1227,7 @@ dependencies = [ "security-framework", "security-framework-sys", "webpki-root-certs", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1238,9 +1238,9 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f" [[package]] name = "rustls-webpki" -version = "0.103.15" +version = "0.103.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" +checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281" dependencies = [ "aws-lc-rs", "ring", @@ -1501,9 +1501,9 @@ dependencies = [ [[package]] name = "tokio" -version = "1.53.2" +version = "1.54.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" +checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3" dependencies = [ "bytes", "libc", @@ -1767,9 +1767,9 @@ dependencies = [ [[package]] name = "webpki-root-certs" -version = "1.0.9" +version = "1.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b" +checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a" dependencies = [ "rustls-pki-types", ] @@ -1780,7 +1780,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 16930a54..08d0d073 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -368,6 +368,7 @@ catalogs: overrides: sharp@<0.35.5: 0.35.5 + undici@<7.30.1: 7.30.2 patchedDependencies: '@cloudflare/kumo@2.14.0': 198f9be784beeb608a5d59b175d6085d7b4f0291567d57b089a85da1fef5f9d7 @@ -4510,15 +4511,15 @@ packages: engines: {node: '>=10'} hasBin: true - seroval-plugins@1.6.8: - resolution: {integrity: sha512-N7mWAMydj89EnYTHtRpS3LBrAz3J9O6oVrqpuXuvlAHfAUG8WEKqtbAd7SBiJNY5NfCAFhSdyAh7wI4Shjqy4g==} - engines: {node: '>=10'} + seroval-plugins@1.7.8: + resolution: {integrity: sha512-SCfCNzJ8CEz3spf1jNd6XE7mrtrKMchVRMGLFNUEXjY0wIUhKl1bXhkNG3/i0X8uLCWLOhUdMjcM286JZqnCbg==} + engines: {node: '>=20'} peerDependencies: seroval: ^1.0 - seroval@1.6.8: - resolution: {integrity: sha512-HlSgSAkTk4EqHcje1ptJjfZi1YDv5KbhVJ/d3P7T/nAXua2VmDu+AKDX5VTdFfZf48nDkWB2TKYt0DrCSa+3wg==} - engines: {node: '>=10'} + seroval@1.7.9: + resolution: {integrity: sha512-ocL7l8aqYWy/dXDHQF3Z8bt5R4Z9IBB4hASCkBDQhl3ZUclxVEzRMQNmRNshiEEIPF1g7uz+2nENDqg+9TU86A==} + engines: {node: '>=20'} set-cookie-parser@3.1.2: resolution: {integrity: sha512-5/r/lTwbJ3zQ+qwdUFZYeRNqda7P5HD8zQKqlSjdGt1/S0cjLAphHusj4Y58ahDtWn/g32xrIS58/ikOvwl0Lw==} @@ -4668,16 +4669,16 @@ packages: undici-types@8.9.0: resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} - engines: {node: '>=20.18.1'} - undici@7.30.1: resolution: {integrity: sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==} engines: {node: '>=20.18.1'} - undici@8.11.2: - resolution: {integrity: sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==} + undici@7.30.2: + resolution: {integrity: sha512-mLyPQnHwUxaM/rideoK/+KL8DaAJLRl4aBCfmX444aCSLnIaomqPLtNRe2jdCYcsk5wZzXrDIQC8ZeYNRAYyIA==} + engines: {node: '>=20.18.1'} + + undici@8.12.4: + resolution: {integrity: sha512-8Mx+uNKKER2bA4AdtedkqRbwUCIJFr2nJckXRe5yrDqzePqwLP7VNcctN8/XdmDSbF7mS+jJKIszlL+vbam1VA==} engines: {node: '>=22.19.0'} unenv@2.0.0-rc.24: @@ -6401,8 +6402,8 @@ snapshots: dependencies: '@tanstack/history': 1.162.5 cookie-es: 3.1.1 - seroval: 1.6.8 - seroval-plugins: 1.6.8(seroval@1.6.8) + seroval: 1.7.9 + seroval-plugins: 1.7.8(seroval@1.7.9) '@tanstack/store@0.11.2': {} @@ -7839,7 +7840,7 @@ snapshots: dependencies: '@cspotcode/source-map-support': 0.8.1 sharp: 0.35.5(@types/node@26.6.5) - undici: 7.28.0 + undici: 7.30.2 workerd: 1.20260730.1 ws: 8.21.0 youch: 4.1.0-beta.10 @@ -8240,11 +8241,11 @@ snapshots: semver@7.8.5: {} - seroval-plugins@1.6.8(seroval@1.6.8): + seroval-plugins@1.7.8(seroval@1.7.9): dependencies: - seroval: 1.6.8 + seroval: 1.7.9 - seroval@1.6.8: {} + seroval@1.7.9: {} set-cookie-parser@3.1.2: {} @@ -8424,11 +8425,11 @@ snapshots: undici-types@8.9.0: {} - undici@7.28.0: {} - undici@7.30.1: {} - undici@8.11.2: {} + undici@7.30.2: {} + + undici@8.12.4: {} unenv@2.0.0-rc.24: dependencies: @@ -8449,7 +8450,7 @@ snapshots: css-tree: 3.2.1 fnv1a-64: 0.1.2 std-env: 4.3.0 - undici: 8.11.2 + undici: 8.12.4 unist-util-find-after@5.0.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 0c6536f6..d8c68312 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -95,8 +95,14 @@ minimumReleaseAgeExclude: # GHSA-rgj7-g3m4-5g8c. Only Miniflare's Images binding and cf.image mocks load it; Cloudhal uses # neither. Monorepo installs only (overrides are not published). Remove when `pnpm why -r sharp` # shows nothing below 0.35.5 without it (ADR-0012, addendum 2026-10-25). +# Miniflare 4.20260730.0 (ADR-0012's pin) also pins undici exactly to 7.28.0, below the fixes for +# GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c, +# GHSA-rfgv-xxqx-mfg5, GHSA-w293-vg96-wgc3, GHSA-4cwx-7wf7-3272 and the medium/low undici 7.x +# advisories patched in 7.29.0, 7.29.1 and 7.30.1 (Dependabot alerts #5-#32 on 2026-11-08). Every +# other undici 7.x in the tree is already 7.30.1+. Remove when Miniflare 4 is no longer pinned. overrides: "sharp@<0.35.5": 0.35.5 + "undici@<7.30.1": 7.30.2 patchedDependencies: '@cloudflare/kumo@2.14.0': patches/@cloudflare__kumo@2.14.0.patch