Repository navigation
fix(security): resolve Dependabot alerts across Go, npm and Python deps - #70
Merged
Merged
Conversation
…tor->Rewrite Dependency bumps (resolves all Dependabot alerts for src/go.mod): - golang.org/x/crypto 0.48.0 -> 0.58.0 - golang.org/x/net 0.51.0 -> 0.62.0 - google.golang.org/grpc 1.79.3 -> 1.85.0 - go.opentelemetry.io/otel* 1.40.0 -> 1.47.0 - github.com/quic-go/quic-go -> 0.59.1+, webtransport-go -> 0.13.0 - github.com/libp2p/go-libp2p 0.47.0 -> 0.51.0 (drops unmaintained pion/stun v1 and pion/dtls/v2, now on patched v3 majors) - klauspost/compress, go-ipld-prime, buger/jsonparser bumps The libp2p/quic-go upgrades make httputil.ReverseProxy.Director deprecation (Go 1.26) surface in staticcheck; migrate all proxy sites to the Rewrite API (hop-by-hop handling and X-Forwarded-* semantics are handled by ServeHTTP, URLs/headers set via ProxyRequest.Out). Verified: go build, make lint (0 issues), make test (672 passed). govulncheck clean except GO-2024-3218 (kad-dht, no patched release). Entire-Checkpoint: 01M6EBC462TSQSDRTKB3NYFQ6M
uv lock --upgrade for auth, benchmark_overhead, benchmark_convergence: - pillow -> 13.0.0 (critical, multiple advisories) - aiohttp -> 3.14.5 - certifi -> 2026.10.23 (critical) - starlette -> 1.10.0, anyio -> 4.16.0, multidict, idna, pygments, pytest auth test suite passes (14/14); locks verified with uv lock --check. Entire-Checkpoint: 01M6EBC4XJ2G731V84TWVP373B
- next 16.1.6 -> 16.4.4 (critical advisories), undici -> 7.30.1, vite 7.3.7 and other transitive fixes via npm audit fix - vitest 3.2.7 -> 5.0.5 (tinypool critical, @vitest/mocker moderate) - overrides: glob ^14.0.2, minimatch ^11.0.1 (command injection / DoS advisories via opennextjs chain); scoped esbuild ^0.28.1 override for fumadocs-mdx (low) - pin fumadocs-mdx 14.2.9 (14.3.x imports fumadocs-core internals that 16.6.x does not export) npm audit: 0 vulnerabilities. Build and vitest suite (18/18) pass. Entire-Checkpoint: 01M6EBC5KPEX6P7TNXR1VQPH1V
Contributor
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
Test Coverage Report 📊Click to view detailed coverageSummary: |
Dependency upgrades in this PR require go 1.26 (libp2p 0.51, quic-go, otel 1.47). The prebuilt golangci-lint v2.6.2 binary is compiled with go1.25 and panics loading such packages: panic: package requires newer Go version go1.26 (application built with go1.25) v2.15.0 is built with go1.27. Verified locally: 0 issues with the same config. Entire-Checkpoint: 01M6EBTPDM768NFPA82VCPJJS7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears every Dependabot alert against manifests that exist on
main:src/go.mod(Go)pion/stunv1 andpion/dtls/v2(no patched release exists for those majors); they move to patched v3 majorshttputil.ReverseProxysites from deprecatedDirectortoRewrite(surfaced by Go 1.26 stdlib deprecation in staticcheck)docs/(npm)contrib/(Python)uv lock --upgradein auth, benchmark_overhead, benchmark_convergenceValidation
go build✓ ·make lint0 issues ✓ ·make test672 passed ✓npm audit: 0 vulnerabilities · docs build ✓ · vitest 18/18 ✓uv lock --check✓ · contrib/auth pytest 14/14 ✓Stale alerts
~230 remaining open alerts point at manifests deleted from
main(src/ocf-core/go.mod, top-levelcontrib/benchmark_{overhead,convergence}/uv.lock) — Dependabot should auto-dismiss them on its next scan ofmainafter this merges; if not they can be bulk-dismissed as stale.