Skip to content

fix(deps): bump web deps and go builder for HIGH CVEs - #15

Merged
danielrpof merged 3 commits into
mainfrom
fix/trivy-web-deps
Oct 31, 2026
Merged

fix(deps): bump web deps and go builder for HIGH CVEs#15
danielrpof merged 3 commits into
mainfrom
fix/trivy-web-deps

Conversation

@danielrpof

@danielrpof danielrpof commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

Clears the Trivy gates: trivy-fs first, then build-scan, which it had been hiding. No package.json or go.mod changes.

 # web/pnpm-lock.yaml, transitive, within existing ranges
-body-parser        2.3.0
+body-parser        2.4.0    # CVE-2026-111181
-systeminformation  5.33.1
+systeminformation  5.33.18  # CVE-2026-116576
-undici             7.30.0
+undici             7.30.1   # CVE-2026-109383, -109829, -109869, -87018
-undici             8.11.2
+undici             8.12.3

 # Dockerfile, go-build stage
-golang:1.26.9-alpine3.24
+golang:1.26.10-alpine3.24   # stdlib CVE-2026-111943

Evidence

  • Before: trivy-fs fails with 6 HIGH findings in web/pnpm-lock.yaml (blocking chore(infra): add terraform bootstrap for azure remote state #14); then build-scan fails with 1 HIGH in the server binary's stdlib.
    After: trivy-fs and build-scan both pass on this branch.
  • pnpm install --frozen-lockfile, prettier and pnpm test ran locally on the updated lockfile.

Merge Danger

Door: two-way

Revert restores the previous lockfile and builder image.

Blast Radius: minor

fix type cuts a patch release. The server binary is rebuilt with Go 1.26.10; the web packages come through tooling (shadcn, jsdom).

@github-actions

github-actions Bot commented Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Coverage

Area Coverage Δ vs main Gate Status
Backend 90.64% — 80% ✅
Frontend 97.65% — 70% ✅

head 2f939e0 · 2026-10-31T01:20:41Z
Delta not available yet — no main baseline cached (first run or evicted). Absolute coverage shown.

@danielrpof danielrpof changed the title fix(deps): bump web dependencies for HIGH CVEs flagged by trivy-fs fix(deps): bump web deps and go builder for HIGH CVEs Oct 31, 2026
@danielrpof
danielrpof merged commit d000201 into main Oct 31, 2026
26 checks passed
@danielrpof
danielrpof deleted the fix/trivy-web-deps branch October 31, 2026 01:25
danielrpof added a commit that referenced this pull request Oct 31, 2026
@danielrpof
docs(planning): point records at squashed commit hashes (#16)
09556e3 
## Summary

Squash merges removed the commits that the planning docs cite.

```diff
-84bc8a8
+67b1bec  # #14
-f45762a
+d000201  # #15
```

## Evidence

- **Before:** `git grep` finds both old hashes in `.planning/`.
  **After:** it finds neither.

## Merge Danger

**Door:** two-way

**Blast Radius:** none

Planning docs only. `docs` type, so no release.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@danielrpof