clawlter/hermes-brain-web
Watch
1
0
Fork
You've already forked hermes-brain-web
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

fix(deps): patch Next.js and YAML vulnerabilities #17

Merged
clawlter merged 6 commits from wt/t_33b1da60 into main 2026-07-12 12:45:54 -04:00
Conversation 4 Commits 6 Files changed 10 +154 -99
clawlter commented 2026-07-11 21:15:22 -04:00
Owner
Copy link

Summary

  • upgrade Next.js and its matching ESLint config from 16.2.3 to 16.2.10
  • override gray-matter's js-yaml to patched 3.15.0 and Next's PostCSS to patched 8.5.10
  • cover YAML anchors and merge keys through the wiki frontmatter loader

The js-yaml override remains inside gray-matter's declared ^3.13.0 compatibility range, so it is a patch/minor resolution supported by the parent dependency. The PostCSS override stays on the same 8.x API line used by Next; the production build and complete application test suite exercise the integration.

Verification

  • npm audit --omit=dev (0 vulnerabilities)
  • npm run lint
  • npm run typecheck
  • npm test (23 files, 51 tests)
  • npm run build

Kanban: t_33b1da60

## Summary - upgrade Next.js and its matching ESLint config from 16.2.3 to 16.2.10 - override gray-matter's js-yaml to patched 3.15.0 and Next's PostCSS to patched 8.5.10 - cover YAML anchors and merge keys through the wiki frontmatter loader The js-yaml override remains inside gray-matter's declared `^3.13.0` compatibility range, so it is a patch/minor resolution supported by the parent dependency. The PostCSS override stays on the same 8.x API line used by Next; the production build and complete application test suite exercise the integration. ## Verification - `npm audit --omit=dev` (0 vulnerabilities) - `npm run lint` - `npm run typecheck` - `npm test` (23 files, 51 tests) - `npm run build` Kanban: t_33b1da60
fix(deps): patch Next.js and YAML vulnerabilities
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 22m1s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 2m4s
Details
b47f65888e
clawlter commented 2026-07-11 21:34:02 -04:00
Author
Owner
Copy link

Security review finding: please refresh the vulnerable development-toolchain dependencies before merge. On this exact branch, npm ci followed by full npm audit reports 7 vulnerabilities, including critical vitest <3.2.6, high-severity Vite and ws advisories, and Babel/esbuild/js-yaml/brace-expansion findings. The application checks otherwise pass (lint, typecheck, 51 tests, and production build). A lockfile refresh resolved these without source changes in independent verification; please rerun full npm audit (not only --omit=dev) afterward.

Security review finding: please refresh the vulnerable development-toolchain dependencies before merge. On this exact branch, `npm ci` followed by full `npm audit` reports 7 vulnerabilities, including critical `vitest <3.2.6`, high-severity Vite and ws advisories, and Babel/esbuild/js-yaml/brace-expansion findings. The application checks otherwise pass (`lint`, `typecheck`, 51 tests, and production build). A lockfile refresh resolved these without source changes in independent verification; please rerun full `npm audit` (not only `--omit=dev`) afterward.
test(browser): stabilize shell graph synchronization
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 6m6s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 2m50s
Details
60e739723a
test(browser): isolate shell tests from XYFlow runtime
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Has been cancelled
Details
CI / Validate lint, types, tests, and production build (pull_request) Has been cancelled
Details
e81276e19d
test(browser): isolate shell tests from graph panel
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 7m35s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 5m45s
Details
df735bb4f8
test(browser): stub base shell graph panel
Some checks failed
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 1m38s
Details
CI / Validate lint, types, tests, and production build (pull_request) Failing after 7m43s
Details
a15a00acc4
ci: rerun flaky browser suite
All checks were successful
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 6m36s
Details
CI / Validate lint, types, tests, and production build (pull_request) Successful in 2m44s
Details
4e14d4a50d
clawlter commented 2026-07-12 09:38:10 -04:00
Author
Owner
Copy link

Integration staging stopped before any remote update. Rebasing the reviewed head onto current main produced a non-identical range-diff in tests/browser-shell.test.tsx: reviewed commit 60e7397 versus candidate cb1756b changes a test closing to }, 15000); and overlaps the shared-runner headroom change on main. An engineer must reconcile whether this is intended test-only behavior and then independently review the resulting signed head. No force-push or merge was performed.

Integration staging stopped before any remote update. Rebasing the reviewed head onto current main produced a non-identical range-diff in tests/browser-shell.test.tsx: reviewed commit 60e7397 versus candidate cb1756b changes a test closing to }, 15000); and overlaps the shared-runner headroom change on main. An engineer must reconcile whether this is intended test-only behavior and then independently review the resulting signed head. No force-push or merge was performed.
clawlter force-pushed wt/t_33b1da60 from 4e14d4a50d
All checks were successful
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 6m36s
Details
CI / Validate lint, types, tests, and production build (pull_request) Successful in 2m44s
Details
to d0219d5431
All checks were successful
Build and publish container image / Build Docker image and publish package tags (pull_request) Successful in 5m26s
Details
CI / Validate lint, types, tests, and production build (pull_request) Successful in 2m46s
Details
Build and publish container image / Build Docker image and publish package tags (push) Successful in 52s
Details
CI / Validate lint, types, tests, and production build (push) Successful in 8m42s
Details
2026-07-12 10:18:44 -04:00 Compare
clawlter commented 2026-07-12 10:19:58 -04:00
Author
Owner
Copy link

Integration staging update (unmerged): reviewed head 4e14d4a50d087b013b83ce2e31322743fee38b0d → staged head d0219d54310cd1f43118411c3139fb7c1bc5c146. Rebased signed commits onto main 383b526. The reviewed aggregate delta is preserved except that the first BrowserShell test retains main’s inherited 15s runner-headroom timeout; no product code was changed by reconciliation. Local npm ci, lint, typecheck, full Vitest, and production build all pass. Required exact-head Forgejo checks are running; this changed head remains for fresh independent review.

Integration staging update (unmerged): reviewed head `4e14d4a50d087b013b83ce2e31322743fee38b0d` → staged head `d0219d54310cd1f43118411c3139fb7c1bc5c146`. Rebased signed commits onto main 383b526. The reviewed aggregate delta is preserved except that the first BrowserShell test retains main’s inherited 15s runner-headroom timeout; no product code was changed by reconciliation. Local `npm ci`, lint, typecheck, full Vitest, and production build all pass. Required exact-head Forgejo checks are running; this changed head remains for fresh independent review.
clawlter commented 2026-07-12 11:27:17 -04:00
Author
Owner
Copy link

Exact-head staging checks are green for d0219d54310cd1f43118411c3139fb7c1bc5c146: both protected pull-request contexts succeeded. Current main is an ancestor and every staged post-main commit has a good signature. This PR remains unmerged and awaits independent staged-head review.

Exact-head staging checks are green for `d0219d54310cd1f43118411c3139fb7c1bc5c146`: both protected pull-request contexts succeeded. Current main is an ancestor and every staged post-main commit has a good signature. This PR remains unmerged and awaits independent staged-head review.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/hermes-brain-web!17
No description provided.