fix: resolve high-severity dependabot security alerts

[onlyjackfrost]

Summary

• wren-ui: Upgrade vulnerable transitive dependencies via yarn resolutions:
  • node-forge 1.3.2 -> 1.4.0 (Dependabot alerts 274-277)
  • lodash 4.17.23 -> 4.18.0 (Dependabot alert 280)
  • fast-xml-parser 4.5.4 -> 5.5.6 (Dependabot alert 245)
  • flatted 3.3.1 -> 3.4.2 (Dependabot alerts 231, 239)
  • tar 7.5.7 -> 7.5.11 (Dependabot alerts 221, 223)
  • immutable 3.7.6 -> 3.8.3 (Dependabot alert 222)
  • picomatch 2.3.1 -> 2.3.2 (Dependabot alert from transitive deps)
• wren-launcher: Upgrade Go module dependencies:
  • github.com/moby/spdystream v0.5.0 -> v0.5.1 (Dependabot alert 292)
  • go.opentelemetry.io/otel/sdk v1.36.0 -> v1.43.0 (Dependabot alerts 213, 273)
  • Bumps CI Go version from 1.24 to 1.25 (required by otel/sdk v1.43.0)

Skipped: next (requires major version upgrade 14 -> 15), docker/docker (no patch available), everything in wren-ai-service/.

Test plan

• Verify wren-ui builds successfully (yarn build)
• Verify wren-launcher builds successfully (go build ./...)
• Verify wren-launcher CI passes with Go 1.25
• Confirm Dependabot alerts are resolved after merge

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated backend dependency versions for improved reliability and security.
  • Pinned UI package dependency resolutions to newer, safer versions.
  • Switched TypeScript module resolution to the bundler mode to align build behavior with modern toolchains.
  • Updated the release workflow to use a newer Go toolchain version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 48bc8c2b-ca6a-47d5-874e-8fe8b2ea653b

📥 Commits

Reviewing files that changed from the base of the PR and between 77eec09 and 0bafa88.

📒 Files selected for processing (1)

• wren-ui/tsconfig.json

✅ Files skipped from review due to trivial changes (1)

• wren-ui/tsconfig.json

---

Walkthrough

Bumps several indirect Go dependencies in wren-launcher/go.mod, updates resolution pins in wren-ui/package.json, switches TypeScript moduleResolution to bundler in wren-ui/tsconfig.json, and updates the GitHub Actions Go version in .github/workflows/create-rc-release.yaml.

Changes

Cohort / File(s)	Summary
Go module dependencies wren-launcher/go.mod	Updated indirect dependencies: go.opentelemetry.io/otel* modules from v1.39.0 → v1.43.0, github.com/moby/spdystream v0.5.0 → v0.5.1, and golang.org/x/sys v0.41.0 → v0.42.0. No exported API changes.
UI package resolutions wren-ui/package.json	Adjusted resolutions: pinned tar→7.5.11, fast-xml-parser→4.5.5, lodash→4.18.1; added overrides for node-forge, flatted, immutable, and picomatch.
TypeScript config wren-ui/tsconfig.json	Changed moduleResolution from node to bundler.
CI workflow .github/workflows/create-rc-release.yaml	Set up Go version to 1.25 (was 1.23.0); workflow steps otherwise unchanged.

Sequence Diagram(s)

(omitted — changes are dependency/configuration updates without new multi-component runtime control flow)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix(deps): upgrade grpc-go to v1.79.3 (critical CVE) #2173: Overlapping OpenTelemetry and golang.org/x/sys updates in wren-launcher/go.mod.
• chore(wren-ui): upgrade lodash to 4.17.23 to fix CVE-2025-13465 #2149: Related change to wren-ui/package.json lodash resolution.
• fix(wren-ui): resolve CVE-2026-25896 by upgrading fast-xml-parser to 4.5.4 #2147: Related update to wren-ui/package.json fast-xml-parser resolution.

Suggested labels

module/ui, ci/ui

Suggested reviewers

• fredalai
• wwwy3y3

Poem

🐰 I hopped through lockfiles, light and spry,

Pinned parsers and lodash up toward the sky.
Go leapt forward to one-point-two-five,
TypeScript learned a new way to arrive.
A tiny update — the launcher's rabbit jive.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the PR: resolving high-severity Dependabot security alerts by upgrading vulnerable dependencies across wren-ui and wren-launcher.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-security-alerts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (1)

wren-ui/package.json (1)

97-114: Post-merge validation: run the full test/build matrix to ensure the security updates don't break functionality.

The resolved versions are correctly pinned in yarn.lock (all 16 packages match their resolutions), but the security changes need functional validation. Lodash is extensively used across the codebase, and BigQuery/DuckDB data flows exist in src/apollo/server/adaptors and src/apollo/server/dataSource.ts that depend on the updated packages.

Recommended before merge completion:

• Run yarn test and yarn build to validate the security update doesn't break existing functionality
• Smoke-test data-source flows (BigQuery/DuckDB/GCS) to ensure cloud SDK chains work with the updated dependencies
• If feasible, run yarn test:e2e to catch any integration issues in end-to-end scenarios

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@wren-ui/package.json` around lines 97 - 114, Run the full post-merge
validation: execute yarn test and yarn build, then smoke-test the
BigQuery/DuckDB/GCS data flows implemented in src/apollo/server/adaptors and
src/apollo/server/dataSource.ts (exercise the BigQuery and DuckDB adapters and
any methods that fetch/stream data) and, if available, run yarn test:e2e to
catch integration issues; report any failing tests or runtime errors and roll
back or pin the specific dependency causing breakage.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/wren-launcher-ci.yaml:
- Line 29: Update the GitHub Actions release workflow to use Go 1.25.x by
changing the setup-go step in create-rc-release.yaml: locate the step that uses
actions/setup-go@v4 and set the with.go-version value to "1.25" (replace the
current "1.23.0"), ensuring the release build matches wren-launcher/go.mod's
requirement for go >= 1.25.0.

In `@wren-launcher/go.mod`:
- Around line 146-151: The go.mod currently mixes OpenTelemetry SDK v1.43.0 with
OTLP exporters at v1.35.0 which is incompatible; update the versions so they
match by either downgrading go.opentelemetry.io/otel/sdk/metric (and any otel
core/modules) to v1.35.0 or upgrading all exporters and contrib instrumentation
to v1.43.0 — specifically adjust the module versions for
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc,
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp,
go.opentelemetry.io/otel/exporters/otlp/otlptrace,
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, add/align
otlptracehttp if present, and the contrib modules
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc and
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp so all otel
packages use the same coordinated version.

In `@wren-ui/package.json`:
- Line 109: Update the lodash dependency in package.json from "4.18.0" to
"4.18.1": open package.json, locate the "lodash" entry (currently "4.18.0") and
change the version string to "4.18.1", then run your package manager
(npm/yarn/pnpm) to reinstall/update lockfile so the project uses the fixed
lodash 4.18.1 release.
- Line 108: The resolutions entry forcing "fast-xml-parser": "5.5.6" causes a
breaking major upgrade for transitive consumers like `@google-cloud/storage` which
expects v4; change the resolutions value in package.json to pin fast-xml-parser
to a v4 security-patched release (e.g., "4.5.5" or latest 4.5.x) so the GHSA fix
is applied without crossing the major-version boundary; update the package.json
"resolutions" key for fast-xml-parser and run install/lockfile refresh to ensure
the v4 patch is used by the lockfile.

---

Nitpick comments:
In `@wren-ui/package.json`:
- Around line 97-114: Run the full post-merge validation: execute yarn test and
yarn build, then smoke-test the BigQuery/DuckDB/GCS data flows implemented in
src/apollo/server/adaptors and src/apollo/server/dataSource.ts (exercise the
BigQuery and DuckDB adapters and any methods that fetch/stream data) and, if
available, run yarn test:e2e to catch integration issues; report any failing
tests or runtime errors and roll back or pin the specific dependency causing
breakage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 5f72bb24-c95c-4eca-ae29-5ab2f1866ac0

📥 Commits

Reviewing files that changed from the base of the PR and between cb8e024 and 6f88683.

⛔ Files ignored due to path filters (2)

• wren-launcher/go.sum is excluded by !**/*.sum
• wren-ui/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (3)

• .github/workflows/wren-launcher-ci.yaml
• wren-launcher/go.mod
• wren-ui/package.json

[onlyjackfrost]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[onlyjackfrost]

Note: wren-launcher CI failure is pre-existing on main

The Wren Launcher CI job (golangci-lint + go vet) is failing, but this is not caused by this PR. The same failure reproduces on main:

# github.com/docker/buildx/util/dockerutil
cannot use dockerclient.WithTraceOptions(...) (value of func type "github.com/docker/docker/client".Opt)
  as "github.com/moby/moby/client".Opt value in argument to append

# github.com/docker/buildx/driver/docker-container
cannot use rp (variable of struct type "github.com/moby/moby/api/types/container".RestartPolicy)
  as "github.com/docker/docker/api/types/container".RestartPolicy value in struct literal

Root cause

docker/compose/v2@v2.40.3 pulls in moby/moby/api@v1.54.0 and moby/moby/client@v0.3.0 as indirect dependencies (the new modular package path), while docker/buildx@v0.29.1 (a transitive dep of compose) still imports github.com/docker/docker (the legacy path).

Go treats moby/moby/api/types/container.RestartPolicy and docker/docker/api/types/container.RestartPolicy as different types, even though they're the same upstream codebase. This causes type mismatch errors at compile time.

This is a known transitional issue in the Docker ecosystem as they migrate from github.com/docker/docker → github.com/moby/moby sub-modules. buildx@v0.33.0 has completed the migration, but compose/v2@v2.40.3 (the latest) has not yet, so there's currently no clean version combination.

Recommendation

Track this separately — once docker/compose/v2 releases a version that uses moby/moby, both deps can be upgraded together to resolve the conflict.