Skip to content

Commit f933e43

Browse files
onlyjackfrostclaude
onlyjackfrost
and
claude
committed
fix: resolve high-severity dependabot security alerts
wren-ui: upgrade node-forge, lodash, fast-xml-parser, flatted, tar, immutable, picomatch via yarn resolutions wren-launcher: upgrade moby/spdystream v0.5.0 → v0.5.1, otel/sdk v1.39.0 → v1.43.0 via go mod Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent cb8e024 commit f933e43

4 files changed

Lines changed: 80 additions & 58 deletions

File tree

‎wren-launcher/go.mod‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ require (
105105
github.com/moby/moby/api v1.54.0 // indirect
106106
github.com/moby/moby/client v0.3.0 // indirect
107107
github.com/moby/patternmatcher v0.6.1 // indirect
108-
github.com/moby/spdystream v0.5.0 // indirect
108+
github.com/moby/spdystream v0.5.1 // indirect
109109
github.com/moby/sys/atomicwriter v0.1.0 // indirect
110110
github.com/moby/sys/capability v0.4.0 // indirect
111111
github.com/moby/sys/mountinfo v0.7.2 // indirect
@@ -150,7 +150,7 @@ require (
150150
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 // indirect
151151
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect
152152
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect
153-
go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
153+
go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
154154
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
155155
go.uber.org/mock v0.6.0 // indirect
156156
go.yaml.in/yaml/v2 v2.4.3 // indirect
@@ -202,13 +202,13 @@ require (
202202
github.com/pterm/pterm v0.12.79
203203
github.com/sirupsen/logrus v1.9.4 // indirect
204204
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
205-
go.opentelemetry.io/otel v1.39.0 // indirect
205+
go.opentelemetry.io/otel v1.43.0 // indirect
206206
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect
207-
go.opentelemetry.io/otel/metric v1.39.0 // indirect
208-
go.opentelemetry.io/otel/sdk v1.39.0 // indirect
209-
go.opentelemetry.io/otel/trace v1.39.0 // indirect
207+
go.opentelemetry.io/otel/metric v1.43.0 // indirect
208+
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
209+
go.opentelemetry.io/otel/trace v1.43.0 // indirect
210210
golang.org/x/sync v0.19.0 // indirect
211-
golang.org/x/sys v0.41.0 // indirect
211+
golang.org/x/sys v0.42.0 // indirect
212212
golang.org/x/time v0.14.0 // indirect
213213
gopkg.in/yaml.v3 v3.0.1
214214
)

‎wren-launcher/go.sum‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -351,8 +351,8 @@ github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x
351351
github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
352352
github.com/moby/policy-helpers v0.0.0-20260211190020-824747bfdd3c h1:hRUo0Ir9PEaa0PQCgg8WvGku0sgmTo/NgnCzMb83iII=
353353
github.com/moby/policy-helpers v0.0.0-20260211190020-824747bfdd3c/go.mod h1:2P1OGoTVIrybI4M7yhpkDpqiwOnI3yR+HnNhEyo8ovs=
354-
github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
355-
github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
354+
github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
355+
github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
356356
github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
357357
github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
358358
github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
@@ -522,8 +522,8 @@ go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.
522522
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0/go.mod h1:rjbQTDEPQymPE0YnRQp9/NuPwwtL0sesz/fnqRW/v84=
523523
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
524524
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
525-
go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
526-
go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
525+
go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
526+
go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
527527
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 h1:cEf8jF6WbuGQWUVcqgyWtTR0kOOAWY1DYZ+UhvdmQPw=
528528
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0/go.mod h1:k1lzV5n5U3HkGvTCJHraTAGJ7MqsgL1wrGwTj1Isfiw=
529529
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 h1:nKP4Z2ejtHn3yShBb+2KawiXgpn8In5cT7aO2wXuOTE=
@@ -534,14 +534,14 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 h1:in9O8
534534
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0/go.mod h1:Rp0EXBm5tfnv0WL+ARyO/PHBEaEAT8UUHQ6AGJcSq6c=
535535
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 h1:Ckwye2FpXkYgiHX7fyVrN1uA/UYd9ounqqTuSNAv0k4=
536536
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0/go.mod h1:teIFJh5pW2y+AN7riv6IBPX2DuesS3HgP39mwOspKwU=
537-
go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
538-
go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
539-
go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
540-
go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
541-
go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
542-
go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
543-
go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
544-
go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
537+
go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
538+
go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
539+
go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
540+
go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
541+
go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
542+
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
543+
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
544+
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
545545
go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
546546
go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
547547
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -604,8 +604,8 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc
604604
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
605605
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
606606
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
607-
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
608-
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
607+
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
608+
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
609609
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
610610
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
611611
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

‎wren-ui/package.json‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -102,12 +102,16 @@
102102
"glob": "10.5.0",
103103
"js-yaml": "4.1.1",
104104
"jws": "4.0.1",
105-
"tar": "7.5.8",
105+
"tar": "7.5.11",
106106
"vega-selections": "6.1.2",
107107
"vega-functions": "6.1.1",
108-
"fast-xml-parser": "4.5.4",
109-
"lodash": "4.17.23",
110-
"minimatch": "4.2.5"
108+
"fast-xml-parser": "5.5.6",
109+
"lodash": "4.18.0",
110+
"minimatch": "4.2.5",
111+
"node-forge": "1.4.0",
112+
"flatted": "3.4.2",
113+
"immutable": "3.8.3",
114+
"picomatch": "2.3.2"
111115
},
112116
"_moduleAliases": {
113117
"@server": "src/apollo/server"

‎wren-ui/yarn.lock‎

Lines changed: 51 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -7559,14 +7559,25 @@ __metadata:
75597559
languageName: node
75607560
linkType: hard
75617561

7562-
"fast-xml-parser@npm:4.5.4":
7563-
version: 4.5.4
7564-
resolution: "fast-xml-parser@npm:4.5.4"
7562+
"fast-xml-builder@npm:^1.1.4":
7563+
version: 1.1.5
7564+
resolution: "fast-xml-builder@npm:1.1.5"
75657565
dependencies:
7566-
strnum: "npm:^1.0.5"
7566+
path-expression-matcher: "npm:^1.1.3"
7567+
checksum: 10c0/b814ba5559cb3140de46d2846045607ab4d4c0bfc312a49d22c91efb9f7cd7004971314841e5823eeb467a5bf403e3ade8371b7912200e111df027d42ae51715
7568+
languageName: node
7569+
linkType: hard
7570+
7571+
"fast-xml-parser@npm:5.5.6":
7572+
version: 5.5.6
7573+
resolution: "fast-xml-parser@npm:5.5.6"
7574+
dependencies:
7575+
fast-xml-builder: "npm:^1.1.4"
7576+
path-expression-matcher: "npm:^1.1.3"
7577+
strnum: "npm:^2.1.2"
75677578
bin:
75687579
fxparser: src/cli/cli.js
7569-
checksum: 10c0/7989148650fc1fce988798b62467f7dee0fd5a7ad049373e00e65fbc68f689c119975d03da32c427f0a1f5aad01de2efbd783a48dcdaf3ca41817a8b161ad3e8
7580+
checksum: 10c0/b7aed4f561f57fe4eba91c5e4a4438cb7eb09ac885b32d912eec257b84e6587dea88a7afd5738fd36c1e6a0bce778dfd8fcefea829fcc44ef019753b92e36402
75707581
languageName: node
75717582
linkType: hard
75727583

@@ -7682,10 +7693,10 @@ __metadata:
76827693
languageName: node
76837694
linkType: hard
76847695

7685-
"flatted@npm:^3.2.7, flatted@npm:^3.2.9":
7686-
version: 3.3.1
7687-
resolution: "flatted@npm:3.3.1"
7688-
checksum: 10c0/324166b125ee07d4ca9bcf3a5f98d915d5db4f39d711fba640a3178b959919aae1f7cfd8aabcfef5826ed8aa8a2aa14cc85b2d7d18ff638ddf4ae3df39573eaf
7696+
"flatted@npm:3.4.2":
7697+
version: 3.4.2
7698+
resolution: "flatted@npm:3.4.2"
7699+
checksum: 10c0/a65b67aae7172d6cdf63691be7de6c5cd5adbdfdfe2e9da1a09b617c9512ed794037741ee53d93114276bff3f93cd3b0d97d54f9b316e1e4885dde6e9ffdf7ed
76897700
languageName: node
76907701
linkType: hard
76917702

@@ -8532,10 +8543,10 @@ __metadata:
85328543
languageName: node
85338544
linkType: hard
85348545

8535-
"immutable@npm:~3.7.6":
8536-
version: 3.7.6
8537-
resolution: "immutable@npm:3.7.6"
8538-
checksum: 10c0/efe2bbb2620aa897afbb79545b9eda4dd3dc072e05ae7004895a7efb43187e4265612a88f8723f391eb1c87c46c52fd11e2d1968e42404450c63e49558d7ca4e
8546+
"immutable@npm:3.8.3":
8547+
version: 3.8.3
8548+
resolution: "immutable@npm:3.8.3"
8549+
checksum: 10c0/bafa7b8371b7622bc3d128cd9e6bba3a654b968f09a237929629f43ac26f7e974a5879cd38baad0c26f6f0628753968611bf832add7bf0c44d647bf4306a2988
85398550
languageName: node
85408551
linkType: hard
85418552

@@ -10079,10 +10090,10 @@ __metadata:
1007910090
languageName: node
1008010091
linkType: hard
1008110092

10082-
"lodash@npm:4.17.23":
10083-
version: 4.17.23
10084-
resolution: "lodash@npm:4.17.23"
10085-
checksum: 10c0/1264a90469f5bb95d4739c43eb6277d15b6d9e186df4ac68c3620443160fc669e2f14c11e7d8b2ccf078b81d06147c01a8ccced9aab9f9f63d50dcf8cace6bf6
10093+
"lodash@npm:4.18.0":
10094+
version: 4.18.0
10095+
resolution: "lodash@npm:4.18.0"
10096+
checksum: 10c0/0c5a7c5a4ea1db59ade40ff03cc8bfc7ea79806f5639ff4c7ee581811c8d88248bf1da608199b9d3614d8db133088bd434f3307c3951a96a821044f72a5ba810
1008610097
languageName: node
1008710098
linkType: hard
1008810099

@@ -11378,10 +11389,10 @@ __metadata:
1137811389
languageName: node
1137911390
linkType: hard
1138011391

11381-
"node-forge@npm:^1.3.1":
11382-
version: 1.3.2
11383-
resolution: "node-forge@npm:1.3.2"
11384-
checksum: 10c0/1def35652c93a588718a6d0d0b4f33e3e7de283aa6f4c00d01d1605d6ccce23fb3b59bcbfb6434014acd23a251cfcc2736052b406f53d94e1b19c09d289d0176
11392+
"node-forge@npm:1.4.0":
11393+
version: 1.4.0
11394+
resolution: "node-forge@npm:1.4.0"
11395+
checksum: 10c0/67330a5f1f95257a4c8a93b7d555abe87b5f15e350123aa396c97a21a8ca94f9c6549008eb2c73668a91e0d7e3a905785acbd8f8bd0751c29401292011f8f8e1
1138511396
languageName: node
1138611397
linkType: hard
1138711398

@@ -11870,6 +11881,13 @@ __metadata:
1187011881
languageName: node
1187111882
linkType: hard
1187211883

11884+
"path-expression-matcher@npm:^1.1.3":
11885+
version: 1.5.0
11886+
resolution: "path-expression-matcher@npm:1.5.0"
11887+
checksum: 10c0/646cb5bc66cd7d809a52288336f3ac1e6223f156fd8e912936e490e590f7f93e8056d4fd25fcbcc7da61bb698fa520112cb050372a3f65e7b79bd4afa0f77610
11888+
languageName: node
11889+
linkType: hard
11890+
1187311891
"path-key@npm:^3.0.0, path-key@npm:^3.1.0":
1187411892
version: 3.1.1
1187511893
resolution: "path-key@npm:3.1.1"
@@ -12038,10 +12056,10 @@ __metadata:
1203812056
languageName: node
1203912057
linkType: hard
1204012058

12041-
"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1, picomatch@npm:^2.2.3, picomatch@npm:^2.3.1":
12042-
version: 2.3.1
12043-
resolution: "picomatch@npm:2.3.1"
12044-
checksum: 10c0/26c02b8d06f03206fc2ab8d16f19960f2ff9e81a658f831ecb656d8f17d9edc799e8364b1f4a7873e89d9702dff96204be0fa26fe4181f6843f040f819dac4be
12059+
"picomatch@npm:2.3.2":
12060+
version: 2.3.2
12061+
resolution: "picomatch@npm:2.3.2"
12062+
checksum: 10c0/a554d1709e59be97d1acb9eaedbbc700a5c03dbd4579807baed95100b00420bc729335440ef15004ae2378984e2487a7c1cebd743cfdb72b6fa9ab69223c0d61
1204512063
languageName: node
1204612064
linkType: hard
1204712065

@@ -14240,10 +14258,10 @@ __metadata:
1424014258
languageName: node
1424114259
linkType: hard
1424214260

14243-
"strnum@npm:^1.0.5":
14244-
version: 1.0.5
14245-
resolution: "strnum@npm:1.0.5"
14246-
checksum: 10c0/64fb8cc2effbd585a6821faa73ad97d4b553c8927e49086a162ffd2cc818787643390b89d567460a8e74300148d11ac052e21c921ef2049f2987f4b1b89a7ff1
14261+
"strnum@npm:^2.1.2":
14262+
version: 2.2.3
14263+
resolution: "strnum@npm:2.2.3"
14264+
checksum: 10c0/1ee78101f1cd73a5b32f63cfd0be501bd246801a002f5987efef903a49e9297d1b63574e302ab3c06ee5e715c524d6cbdfef010e372ec1ea848e0179836cc208
1424714265
languageName: node
1424814266
linkType: hard
1424914267

@@ -14442,16 +14460,16 @@ __metadata:
1444214460
languageName: node
1444314461
linkType: hard
1444414462

14445-
"tar@npm:7.5.8":
14446-
version: 7.5.8
14447-
resolution: "tar@npm:7.5.8"
14463+
"tar@npm:7.5.11":
14464+
version: 7.5.11
14465+
resolution: "tar@npm:7.5.11"
1444814466
dependencies:
1444914467
"@isaacs/fs-minipass": "npm:^4.0.0"
1445014468
chownr: "npm:^3.0.0"
1445114469
minipass: "npm:^7.1.2"
1445214470
minizlib: "npm:^3.1.0"
1445314471
yallist: "npm:^5.0.0"
14454-
checksum: 10c0/8569db1b49f5d72084cbdcad9d2b39fcc115993186455aa052c1da0a2739b20e2d94af6a23609fc25d3ae63c9fed8b159f3b1d16b699e9ef25e3b8464603d153
14472+
checksum: 10c0/b6bb420550ef50ef23356018155e956cd83282c97b6128d8d5cfe5740c57582d806a244b2ef0bf686a74ce526babe8b8b9061527623e935e850008d86d838929
1445514473
languageName: node
1445614474
linkType: hard
1445714475

0 commit comments

Comments
 (0)