Michal Klos
|
b9077d96d8
|
chore(deps): consolidate dependency and security bumps (#13081)
* chore(deps): consolidate dependency and security bumps
Dependabot PRs applied:
- #12878 qs 6.15.2 -> 6.16.0 (web/web-runtime)
- #13013 alpine 3.24.1 -> 3.24.2
- #13061 actions/checkout -> v7.0.1 (missed instance in k8s.yml)
- #13062 actions/setup-node -> v7.0.0 (missed instance in k8s.yml)
- #13075 simple-git 3.36.0 -> 4.0.1 (security)
- #13076 katex 0.16.45 -> 0.18.2+ (security)
- #13077 dompurify 3.4.13 -> 3.4.16 (security)
- #13079 go deps minor-and-patch group, 18 updates (opa 1.19.0 -> 1.21.1, otel 1.46 -> 1.47, bleve, govips, grpc-gateway, lico, tablewriter, logrus, gjson, x/exp, x/image, genproto, etc.)
Skipped (already satisfied on master): #12513, #12624, #12625, #12633
Manual security bumps via pnpm.overrides (no dependabot PR existed):
- axios -> 1.20.0
- smol-toml -> 1.9.0
- postcss -> 8.5.23
- postcss-selector-parser -> 7.1.6
- colord -> 2.9.4
- unhead -> 2.1.13
- markdown-it -> 14.3.1
- esbuild -> 0.28.1
- brace-expansion 5.0.11 -> 5.0.12
Not fixable: sprintf-js and elliptic have no patched version released upstream yet; left as-is.
go build and pnpm install verified clean.
* chore(deps): fix residual transitive vulns found by trivy
trivy flagged duplicate/stale resolutions that survived the earlier
override pass: dompurify (3.4.12 -> 3.4.16), qs (6.14.2 -> 6.16.0),
and fast-uri (3.1.7 -> 3.1.8, CVE-2026-86472). Added/bumped pnpm.overrides
accordingly. trivy fs scan of web/pnpm-lock.yaml now clean.
* chore(deps): bump reva to bac0e1ee144ab853a81c6b02142032f102dd245a
Pins github.com/owncloud/reva/v2 to bac0e1ee144ab853a81c6b02142032f102dd245a,
pulling in its go-playground/locales and huandu/xstrings version bumps.
Appends this PR to changelog/unreleased/bump-reva.md.
go build ./... verified clean after go mod vendor resync.
* fix(ci): revert unhead override, breaks web build
* revert: keep k8s.yml actions/checkout and setup-node pinned
|
2026-10-07 07:56:56 +02:00 |
|
