fix(deps): resolve moderate-severity Dependabot alerts - #84
Merged
Conversation
src-tauri: bump bytes (1.11.0 -> 1.12.1), serde_with (3.16.1 -> 3.22.0), time (0.3.45 -> 0.3.55) as transitive cargo-update bumps; bump direct deps tauri (2.9.5 -> 2.11.5, fixes an Origin Confusion issue allowing remote pages to invoke local-only IPC commands) and jsonwebtoken (9.3.1 -> 10.4.0, major version, fixes a type-confusion issue in token verification). This codebase only calls `encode`/`EncodingKey` (never `decode`/`Validation`, where the vulnerability lives), and that API is unchanged across the major bump. Verified with `cargo build --release --features velopack-updates` and `cargo test --release` (968/968 passing). glib (0.18.5, needs >= 0.20.0) is NOT fixed: it's pulled in via tauri's own `gtk = "^0.18"` pin (Linux tray icon support), which is not under this project's control. No action possible until tauri itself bumps that pin upstream. mcp-server: bump ajv (8.17.1 -> 8.20.0, ReDoS via `$data` option), within @modelcontextprotocol/sdk's existing declared range. Verified with bun test (73/73 passing). agent-monitor: bump uuid (9.0.1 -> 11.1.1, missing buffer bounds check in v3/v5/v6). Only usage in this codebase is `v4()`, whose API is unchanged across the major bump. No test suite exists for this tool (pre-existing); verified with a clean `tsc --noEmit` pass on the changed surface.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves 7 of 8 open moderate-severity Dependabot alerts (https://github.com/PMTLabs/termflow-core/security/dependabot):
src-tauri/Cargo.lock
tauri2.9.5 -> 2.11.5(#139) — fixes an Origin Confusion issue allowing remote pages to invoke local-only IPC commands. Direct dependency version bump.jsonwebtoken9.3.1 -> 10.4.0(#126) — major version bump; fixes a type-confusion issue in token verification. This codebase only callsencode/Header/EncodingKey::from_secret(neverdecode/Validation, where the bug lives), and that API is unchanged across the bump.time0.3.45 -> 0.3.55(#127),bytes1.11.0 -> 1.12.1(#124),serde_with3.16.1 -> 3.22.0(#142) — transitivecargo update -pbumps.glib(#125, needs >= 0.20.0) — not fixed. It's pulled in viatauri's owngtk = "^0.18"pin for Linux tray-icon support, which isn't a dependency this project declares directly. Confirmed withcargo update -p glib --precise 0.20.0, which fails becausegtk v0.18.2(required bytauri v2.11.5) caps it at^0.18. No action possible until tauri bumps that pin upstream.mcp-server/package-lock.json
ajv8.17.1 -> 8.20.0(feat(terminal): canvas overlay search, Find in both context menus, hard-wrapped path links #68) — ReDoS via the$dataoption. Within@modelcontextprotocol/sdk's existing declared range (^8.17.1).agent-monitor/package-lock.json
uuid9.0.1 -> 11.1.1(Identity separation (pn-/tm-/tb-/pc-) and sibling-aware offload/update #49) — missing buffer bounds check in v3/v5/v6. Major version bump; this codebase's only usage isv4(), whose API is unchanged across it.Test plan
cargo build --release --features velopack-updatessucceedscargo test --release— 968/968 passingbun testinmcp-server— 73/73 passingnpm auditshows 0 high/moderate findings inmcp-serverafter the ajv bumptsc --noEmitclean on the changed surface inagent-monitor(no test suite exists there, pre-existing)