From f933e43a337ebcc428b4deedfe5f20f1a921cd7a Mon Sep 17 00:00:00 2001 From: Andy Yen Date: Thu, 23 Apr 2026 12:42:02 +0800 Subject: [PATCH 1/3] fix: resolve high-severity dependabot security alerts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wren-ui: upgrade node-forge, lodash, fast-xml-parser, flatted, tar, immutable, picomatch via yarn resolutions wren-launcher: upgrade moby/spdystream v0.5.0 → v0.5.1, otel/sdk v1.39.0 → v1.43.0 via go mod Co-Authored-By: Claude Opus 4.6 (1M context) --- wren-launcher/go.mod | 14 ++++---- wren-launcher/go.sum | 28 +++++++-------- wren-ui/package.json | 12 ++++--- wren-ui/yarn.lock | 84 +++++++++++++++++++++++++++----------------- 4 files changed, 80 insertions(+), 58 deletions(-) diff --git a/wren-launcher/go.mod b/wren-launcher/go.mod index f44f62d704..a8599fc607 100644 --- a/wren-launcher/go.mod +++ b/wren-launcher/go.mod @@ -105,7 +105,7 @@ require ( github.com/moby/moby/api v1.54.0 // indirect github.com/moby/moby/client v0.3.0 // indirect github.com/moby/patternmatcher v0.6.1 // indirect - github.com/moby/spdystream v0.5.0 // indirect + github.com/moby/spdystream v0.5.1 // indirect github.com/moby/sys/atomicwriter v0.1.0 // indirect github.com/moby/sys/capability v0.4.0 // indirect github.com/moby/sys/mountinfo v0.7.2 // indirect @@ -150,7 +150,7 @@ require ( go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.39.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 // indirect - go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect + go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect go.opentelemetry.io/proto/otlp v1.9.0 // indirect go.uber.org/mock v0.6.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect @@ -202,13 +202,13 @@ require ( github.com/pterm/pterm v0.12.79 github.com/sirupsen/logrus v1.9.4 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect - go.opentelemetry.io/otel v1.39.0 // indirect + go.opentelemetry.io/otel v1.43.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 // indirect - go.opentelemetry.io/otel/metric v1.39.0 // indirect - go.opentelemetry.io/otel/sdk v1.39.0 // indirect - go.opentelemetry.io/otel/trace v1.39.0 // indirect + go.opentelemetry.io/otel/metric v1.43.0 // indirect + go.opentelemetry.io/otel/sdk v1.43.0 // indirect + go.opentelemetry.io/otel/trace v1.43.0 // indirect golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.41.0 // indirect + golang.org/x/sys v0.42.0 // indirect golang.org/x/time v0.14.0 // indirect gopkg.in/yaml.v3 v3.0.1 ) diff --git a/wren-launcher/go.sum b/wren-launcher/go.sum index 5f57319345..457a23735c 100644 --- a/wren-launcher/go.sum +++ b/wren-launcher/go.sum @@ -351,8 +351,8 @@ github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc= github.com/moby/policy-helpers v0.0.0-20260211190020-824747bfdd3c h1:hRUo0Ir9PEaa0PQCgg8WvGku0sgmTo/NgnCzMb83iII= github.com/moby/policy-helpers v0.0.0-20260211190020-824747bfdd3c/go.mod h1:2P1OGoTVIrybI4M7yhpkDpqiwOnI3yR+HnNhEyo8ovs= -github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU= -github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= +github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y= +github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs= github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk= @@ -522,8 +522,8 @@ go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0. go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0/go.mod h1:rjbQTDEPQymPE0YnRQp9/NuPwwtL0sesz/fnqRW/v84= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg= -go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= -go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= +go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= +go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 h1:cEf8jF6WbuGQWUVcqgyWtTR0kOOAWY1DYZ+UhvdmQPw= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0/go.mod h1:k1lzV5n5U3HkGvTCJHraTAGJ7MqsgL1wrGwTj1Isfiw= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.39.0 h1:nKP4Z2ejtHn3yShBb+2KawiXgpn8In5cT7aO2wXuOTE= @@ -534,14 +534,14 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 h1:in9O8 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0/go.mod h1:Rp0EXBm5tfnv0WL+ARyO/PHBEaEAT8UUHQ6AGJcSq6c= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0 h1:Ckwye2FpXkYgiHX7fyVrN1uA/UYd9ounqqTuSNAv0k4= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.39.0/go.mod h1:teIFJh5pW2y+AN7riv6IBPX2DuesS3HgP39mwOspKwU= -go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= -go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= -go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= +go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= +go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= +go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= +go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= +go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= +go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= +go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A= go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -604,8 +604,8 @@ golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= -golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= +golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= diff --git a/wren-ui/package.json b/wren-ui/package.json index f7ddbcb441..0e9d7b10e4 100644 --- a/wren-ui/package.json +++ b/wren-ui/package.json @@ -102,12 +102,16 @@ "glob": "10.5.0", "js-yaml": "4.1.1", "jws": "4.0.1", - "tar": "7.5.8", + "tar": "7.5.11", "vega-selections": "6.1.2", "vega-functions": "6.1.1", - "fast-xml-parser": "4.5.4", - "lodash": "4.17.23", - "minimatch": "4.2.5" + "fast-xml-parser": "5.5.6", + "lodash": "4.18.0", + "minimatch": "4.2.5", + "node-forge": "1.4.0", + "flatted": "3.4.2", + "immutable": "3.8.3", + "picomatch": "2.3.2" }, "_moduleAliases": { "@server": "src/apollo/server" diff --git a/wren-ui/yarn.lock b/wren-ui/yarn.lock index c2322c3178..47536733f8 100644 --- a/wren-ui/yarn.lock +++ b/wren-ui/yarn.lock @@ -7559,14 +7559,25 @@ __metadata: languageName: node linkType: hard -"fast-xml-parser@npm:4.5.4": - version: 4.5.4 - resolution: "fast-xml-parser@npm:4.5.4" +"fast-xml-builder@npm:^1.1.4": + version: 1.1.5 + resolution: "fast-xml-builder@npm:1.1.5" dependencies: - strnum: "npm:^1.0.5" + path-expression-matcher: "npm:^1.1.3" + checksum: 10c0/b814ba5559cb3140de46d2846045607ab4d4c0bfc312a49d22c91efb9f7cd7004971314841e5823eeb467a5bf403e3ade8371b7912200e111df027d42ae51715 + languageName: node + linkType: hard + +"fast-xml-parser@npm:5.5.6": + version: 5.5.6 + resolution: "fast-xml-parser@npm:5.5.6" + dependencies: + fast-xml-builder: "npm:^1.1.4" + path-expression-matcher: "npm:^1.1.3" + strnum: "npm:^2.1.2" bin: fxparser: src/cli/cli.js - checksum: 10c0/7989148650fc1fce988798b62467f7dee0fd5a7ad049373e00e65fbc68f689c119975d03da32c427f0a1f5aad01de2efbd783a48dcdaf3ca41817a8b161ad3e8 + checksum: 10c0/b7aed4f561f57fe4eba91c5e4a4438cb7eb09ac885b32d912eec257b84e6587dea88a7afd5738fd36c1e6a0bce778dfd8fcefea829fcc44ef019753b92e36402 languageName: node linkType: hard @@ -7682,10 +7693,10 @@ __metadata: languageName: node linkType: hard -"flatted@npm:^3.2.7, flatted@npm:^3.2.9": - version: 3.3.1 - resolution: "flatted@npm:3.3.1" - checksum: 10c0/324166b125ee07d4ca9bcf3a5f98d915d5db4f39d711fba640a3178b959919aae1f7cfd8aabcfef5826ed8aa8a2aa14cc85b2d7d18ff638ddf4ae3df39573eaf +"flatted@npm:3.4.2": + version: 3.4.2 + resolution: "flatted@npm:3.4.2" + checksum: 10c0/a65b67aae7172d6cdf63691be7de6c5cd5adbdfdfe2e9da1a09b617c9512ed794037741ee53d93114276bff3f93cd3b0d97d54f9b316e1e4885dde6e9ffdf7ed languageName: node linkType: hard @@ -8532,10 +8543,10 @@ __metadata: languageName: node linkType: hard -"immutable@npm:~3.7.6": - version: 3.7.6 - resolution: "immutable@npm:3.7.6" - checksum: 10c0/efe2bbb2620aa897afbb79545b9eda4dd3dc072e05ae7004895a7efb43187e4265612a88f8723f391eb1c87c46c52fd11e2d1968e42404450c63e49558d7ca4e +"immutable@npm:3.8.3": + version: 3.8.3 + resolution: "immutable@npm:3.8.3" + checksum: 10c0/bafa7b8371b7622bc3d128cd9e6bba3a654b968f09a237929629f43ac26f7e974a5879cd38baad0c26f6f0628753968611bf832add7bf0c44d647bf4306a2988 languageName: node linkType: hard @@ -10079,10 +10090,10 @@ __metadata: languageName: node linkType: hard -"lodash@npm:4.17.23": - version: 4.17.23 - resolution: "lodash@npm:4.17.23" - checksum: 10c0/1264a90469f5bb95d4739c43eb6277d15b6d9e186df4ac68c3620443160fc669e2f14c11e7d8b2ccf078b81d06147c01a8ccced9aab9f9f63d50dcf8cace6bf6 +"lodash@npm:4.18.0": + version: 4.18.0 + resolution: "lodash@npm:4.18.0" + checksum: 10c0/0c5a7c5a4ea1db59ade40ff03cc8bfc7ea79806f5639ff4c7ee581811c8d88248bf1da608199b9d3614d8db133088bd434f3307c3951a96a821044f72a5ba810 languageName: node linkType: hard @@ -11378,10 +11389,10 @@ __metadata: languageName: node linkType: hard -"node-forge@npm:^1.3.1": - version: 1.3.2 - resolution: "node-forge@npm:1.3.2" - checksum: 10c0/1def35652c93a588718a6d0d0b4f33e3e7de283aa6f4c00d01d1605d6ccce23fb3b59bcbfb6434014acd23a251cfcc2736052b406f53d94e1b19c09d289d0176 +"node-forge@npm:1.4.0": + version: 1.4.0 + resolution: "node-forge@npm:1.4.0" + checksum: 10c0/67330a5f1f95257a4c8a93b7d555abe87b5f15e350123aa396c97a21a8ca94f9c6549008eb2c73668a91e0d7e3a905785acbd8f8bd0751c29401292011f8f8e1 languageName: node linkType: hard @@ -11870,6 +11881,13 @@ __metadata: languageName: node linkType: hard +"path-expression-matcher@npm:^1.1.3": + version: 1.5.0 + resolution: "path-expression-matcher@npm:1.5.0" + checksum: 10c0/646cb5bc66cd7d809a52288336f3ac1e6223f156fd8e912936e490e590f7f93e8056d4fd25fcbcc7da61bb698fa520112cb050372a3f65e7b79bd4afa0f77610 + languageName: node + linkType: hard + "path-key@npm:^3.0.0, path-key@npm:^3.1.0": version: 3.1.1 resolution: "path-key@npm:3.1.1" @@ -12038,10 +12056,10 @@ __metadata: languageName: node linkType: hard -"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1, picomatch@npm:^2.2.3, picomatch@npm:^2.3.1": - version: 2.3.1 - resolution: "picomatch@npm:2.3.1" - checksum: 10c0/26c02b8d06f03206fc2ab8d16f19960f2ff9e81a658f831ecb656d8f17d9edc799e8364b1f4a7873e89d9702dff96204be0fa26fe4181f6843f040f819dac4be +"picomatch@npm:2.3.2": + version: 2.3.2 + resolution: "picomatch@npm:2.3.2" + checksum: 10c0/a554d1709e59be97d1acb9eaedbbc700a5c03dbd4579807baed95100b00420bc729335440ef15004ae2378984e2487a7c1cebd743cfdb72b6fa9ab69223c0d61 languageName: node linkType: hard @@ -14240,10 +14258,10 @@ __metadata: languageName: node linkType: hard -"strnum@npm:^1.0.5": - version: 1.0.5 - resolution: "strnum@npm:1.0.5" - checksum: 10c0/64fb8cc2effbd585a6821faa73ad97d4b553c8927e49086a162ffd2cc818787643390b89d567460a8e74300148d11ac052e21c921ef2049f2987f4b1b89a7ff1 +"strnum@npm:^2.1.2": + version: 2.2.3 + resolution: "strnum@npm:2.2.3" + checksum: 10c0/1ee78101f1cd73a5b32f63cfd0be501bd246801a002f5987efef903a49e9297d1b63574e302ab3c06ee5e715c524d6cbdfef010e372ec1ea848e0179836cc208 languageName: node linkType: hard @@ -14442,16 +14460,16 @@ __metadata: languageName: node linkType: hard -"tar@npm:7.5.8": - version: 7.5.8 - resolution: "tar@npm:7.5.8" +"tar@npm:7.5.11": + version: 7.5.11 + resolution: "tar@npm:7.5.11" dependencies: "@isaacs/fs-minipass": "npm:^4.0.0" chownr: "npm:^3.0.0" minipass: "npm:^7.1.2" minizlib: "npm:^3.1.0" yallist: "npm:^5.0.0" - checksum: 10c0/8569db1b49f5d72084cbdcad9d2b39fcc115993186455aa052c1da0a2739b20e2d94af6a23609fc25d3ae63c9fed8b159f3b1d16b699e9ef25e3b8464603d153 + checksum: 10c0/b6bb420550ef50ef23356018155e956cd83282c97b6128d8d5cfe5740c57582d806a244b2ef0bf686a74ce526babe8b8b9061527623e935e850008d86d838929 languageName: node linkType: hard From 77eec0922956e7493f9472c076c5c48129439248 Mon Sep 17 00:00:00 2001 From: Andy Yen Date: Thu, 23 Apr 2026 12:46:36 +0800 Subject: [PATCH 2/3] fix: address CodeRabbit review feedback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - fast-xml-parser: use 4.5.5 instead of 5.5.6 (v4 has the security patch, avoids breaking major version change for @google-cloud/storage) - lodash: use 4.18.1 instead of 4.18.0 (fixes ReferenceError bug in 4.18.0) - create-rc-release.yaml: bump Go version 1.23.0 → 1.25 to match go.mod Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/create-rc-release.yaml | 2 +- wren-ui/package.json | 4 +-- wren-ui/yarn.lock | 44 +++++++----------------- 3 files changed, 16 insertions(+), 34 deletions(-) diff --git a/.github/workflows/create-rc-release.yaml b/.github/workflows/create-rc-release.yaml index 3bb4431dc0..64ab80762a 100644 --- a/.github/workflows/create-rc-release.yaml +++ b/.github/workflows/create-rc-release.yaml @@ -22,7 +22,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v4 with: - go-version: "1.23.0" + go-version: "1.25" - name: Add rocket emoji to comment run: | diff --git a/wren-ui/package.json b/wren-ui/package.json index 0e9d7b10e4..3f76b0e43b 100644 --- a/wren-ui/package.json +++ b/wren-ui/package.json @@ -105,8 +105,8 @@ "tar": "7.5.11", "vega-selections": "6.1.2", "vega-functions": "6.1.1", - "fast-xml-parser": "5.5.6", - "lodash": "4.18.0", + "fast-xml-parser": "4.5.5", + "lodash": "4.18.1", "minimatch": "4.2.5", "node-forge": "1.4.0", "flatted": "3.4.2", diff --git a/wren-ui/yarn.lock b/wren-ui/yarn.lock index 47536733f8..b7452d3b48 100644 --- a/wren-ui/yarn.lock +++ b/wren-ui/yarn.lock @@ -7559,25 +7559,14 @@ __metadata: languageName: node linkType: hard -"fast-xml-builder@npm:^1.1.4": - version: 1.1.5 - resolution: "fast-xml-builder@npm:1.1.5" - dependencies: - path-expression-matcher: "npm:^1.1.3" - checksum: 10c0/b814ba5559cb3140de46d2846045607ab4d4c0bfc312a49d22c91efb9f7cd7004971314841e5823eeb467a5bf403e3ade8371b7912200e111df027d42ae51715 - languageName: node - linkType: hard - -"fast-xml-parser@npm:5.5.6": - version: 5.5.6 - resolution: "fast-xml-parser@npm:5.5.6" +"fast-xml-parser@npm:4.5.5": + version: 4.5.5 + resolution: "fast-xml-parser@npm:4.5.5" dependencies: - fast-xml-builder: "npm:^1.1.4" - path-expression-matcher: "npm:^1.1.3" - strnum: "npm:^2.1.2" + strnum: "npm:^1.0.5" bin: fxparser: src/cli/cli.js - checksum: 10c0/b7aed4f561f57fe4eba91c5e4a4438cb7eb09ac885b32d912eec257b84e6587dea88a7afd5738fd36c1e6a0bce778dfd8fcefea829fcc44ef019753b92e36402 + checksum: 10c0/e65634f1ddad5c093ab77e54f188d93f2138e18fc91b923575f28ee4aee39439a535ea2f26b83b6c1aebbbcbda2daa7f9295093444c81923bc5bdf76e03f88d7 languageName: node linkType: hard @@ -10090,10 +10079,10 @@ __metadata: languageName: node linkType: hard -"lodash@npm:4.18.0": - version: 4.18.0 - resolution: "lodash@npm:4.18.0" - checksum: 10c0/0c5a7c5a4ea1db59ade40ff03cc8bfc7ea79806f5639ff4c7ee581811c8d88248bf1da608199b9d3614d8db133088bd434f3307c3951a96a821044f72a5ba810 +"lodash@npm:4.18.1": + version: 4.18.1 + resolution: "lodash@npm:4.18.1" + checksum: 10c0/757228fc68805c59789e82185135cf85f05d0b2d3d54631d680ca79ec21944ec8314d4533639a14b8bcfbd97a517e78960933041a5af17ecb693ec6eecb99a27 languageName: node linkType: hard @@ -11881,13 +11870,6 @@ __metadata: languageName: node linkType: hard -"path-expression-matcher@npm:^1.1.3": - version: 1.5.0 - resolution: "path-expression-matcher@npm:1.5.0" - checksum: 10c0/646cb5bc66cd7d809a52288336f3ac1e6223f156fd8e912936e490e590f7f93e8056d4fd25fcbcc7da61bb698fa520112cb050372a3f65e7b79bd4afa0f77610 - languageName: node - linkType: hard - "path-key@npm:^3.0.0, path-key@npm:^3.1.0": version: 3.1.1 resolution: "path-key@npm:3.1.1" @@ -14258,10 +14240,10 @@ __metadata: languageName: node linkType: hard -"strnum@npm:^2.1.2": - version: 2.2.3 - resolution: "strnum@npm:2.2.3" - checksum: 10c0/1ee78101f1cd73a5b32f63cfd0be501bd246801a002f5987efef903a49e9297d1b63574e302ab3c06ee5e715c524d6cbdfef010e372ec1ea848e0179836cc208 +"strnum@npm:^1.0.5": + version: 1.1.2 + resolution: "strnum@npm:1.1.2" + checksum: 10c0/a0fce2498fa3c64ce64a40dada41beb91cabe3caefa910e467dc0518ef2ebd7e4d10f8c2202a6104f1410254cae245066c0e94e2521fb4061a5cb41831952392 languageName: node linkType: hard From 0bafa88f2ecce5957daa9d2cfb42ca09b3d2f2d1 Mon Sep 17 00:00:00 2001 From: Andy Yen Date: Fri, 24 Apr 2026 13:26:40 +0800 Subject: [PATCH 3/3] fix(wren-ui): switch moduleResolution to bundler for vega-lite type compatibility vega-lite v6 uses package.json "exports" for type declarations, which the legacy "node" moduleResolution cannot resolve. Switching to "bundler" is the correct strategy for Next.js apps and fixes TS2307 errors. Co-Authored-By: Claude Opus 4.6 (1M context) --- wren-ui/tsconfig.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wren-ui/tsconfig.json b/wren-ui/tsconfig.json index bc5a18426d..ea8792b253 100644 --- a/wren-ui/tsconfig.json +++ b/wren-ui/tsconfig.json @@ -9,7 +9,7 @@ "noEmit": true, "esModuleInterop": true, "module": "esnext", - "moduleResolution": "node", + "moduleResolution": "bundler", "resolveJsonModule": true, "isolatedModules": true, "jsx": "preserve",