Skip to content

fix: resolve dependency alerts and restore green automation - #84

Merged
anulum merged 9 commits into
mainfrom
anulum/actions-hygiene-20260904
Sep 4, 2026
Merged

fix: resolve dependency alerts and restore green automation#84
anulum merged 9 commits into
mainfrom
anulum/actions-hygiene-20260904

Conversation

@anulum

@anulum anulum commented Sep 4, 2026

Copy link
Copy Markdown
Owner

Summary

Compatibility decision

PR #77 is intentionally not included. MCP 2.1.1 is a major-version update and its branch currently breaks the repository contract suite; the current 1.28.1 pin remains supported and is not associated with an open security alert.

Focused evidence

  • 61 focused OpenCode environment, editor trace, and container workflow contract tests passed
  • the real OpenCode 1.17.20 governed claim and adapter lifecycle reproducer passed
  • Ruff check passed on all changed Python files
  • local npm audit requests timed out without a registry response; hosted CI is the authoritative dependency-audit gate

This PR supersedes #78, #79, #80, #81, #82, and #83.

dependabot Bot and others added 7 commits September 4, 2026 09:29
@dependabot @anulum
build(deps-dev): bump mkdocs-material in /.github/requirements
e73be66 
Bumps [mkdocs-material](https://github.com/squidfunk/mkdocs-material) from 9.7.6 to 9.7.7.
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

---
updated-dependencies:
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@dependabot @anulum
build(deps): bump fast-uri from 3.1.5 to 3.1.7 in /clients/vscode
0d53816 
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.7)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@dependabot @anulum
build(deps): bump the actions-minor-patch group with 4 updates
ee76d20 
Bumps the actions-minor-patch group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

Updates `anchore/sbom-action` from 0.24.0 to 0.24.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](anchore/sbom-action@e22c389...3ad7283)

Updates `github/codeql-action/upload-sarif` from 4.37.8 to 4.37.9
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@db488dd...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-patch
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-patch
- dependency-name: anchore/sbom-action
  dependency-version: 0.24.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-patch
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@dependabot @anulum
build(deps-dev): bump the cockpit-minor-patch group
7ceafab 
Bumps the cockpit-minor-patch group in /clients/cockpit with 4 updates: [@testing-library/react](https://github.com/testing-library/react-testing-library), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) and [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react).

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@types/node` from 26.2.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: cockpit-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: cockpit-minor-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: cockpit-minor-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: cockpit-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@dependabot @anulum
build(deps): bump the github-app-minor-patch group
411649f 
Bumps the github-app-minor-patch group in /integrations/github-app with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [synapse-channel](https://github.com/anulum/synapse-channel) | `0.99.18` | `0.99.21` |
| [build](https://github.com/pypa/build) | `1.5.1` | `1.6.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.5` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.3` | `3.32.4` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.2` |
| [nh3](https://github.com/messense/nh3) | `0.3.6` | `0.3.7` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.3` | `4.11.5` |

Updates `synapse-channel` from 0.99.18 to 0.99.21
- [Release notes](https://github.com/anulum/synapse-channel/releases)
- [Changelog](https://github.com/anulum/synapse-channel/blob/main/CHANGELOG.md)
- [Commits](v0.99.18...v0.99.21)

Updates `build` from 1.5.1 to 1.6.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.1...1.6.0)

Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

Updates `coverage` from 7.15.4 to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.0)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `filelock` from 3.32.3 to 3.32.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.3...3.32.4)

Updates `msgpack` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.2)

Updates `nh3` from 0.3.6 to 0.3.7
- [Release notes](https://github.com/messense/nh3/releases)
- [Commits](messense/nh3@v0.3.6...v0.3.7)

Updates `platformdirs` from 4.11.3 to 4.11.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.3...4.11.5)

---
updated-dependencies:
- dependency-name: synapse-channel
  dependency-version: 0.99.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: build
  dependency-version: 1.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: github-app-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: coverage
  dependency-version: 7.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: github-app-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: filelock
  dependency-version: 3.32.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: msgpack
  dependency-version: 1.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: nh3
  dependency-version: 0.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.11.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-app-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@anulum
fix: complete dependency security updates
2a4ea39 
Signed-off-by: Miroslav Šotek <protoscience@anulum.li>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@anulum
fix: stabilize governed OpenCode acceptance
c0f1756 
Signed-off-by: Miroslav Šotek <protoscience@anulum.li>

Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@anulum
anulum force-pushed the anulum/actions-hygiene-20260904 branch from ace4f70 to c0f1756 Compare September 4, 2026 07:30
@anulum
docs: refresh capability snapshot
10b696e 
Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@anulum
fix: update fflate for ZIP64 advisory
4b757c7 
Seat: 2970473
Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)
@anulum

anulum commented Sep 4, 2026

Copy link
Copy Markdown
Owner Author

Additional hosted-audit finding resolved: fflate 0.8.2 was affected by GHSA-px8p-9vwx-vf98 (ZIP64 uncontrolled resource consumption). The direct exact pin is now 0.8.3, the first patched 0.8.x release. Focused marketplace ZIP tests pass (11/11), and an OSV batch query over all 446 installed VS Code packages reports zero known vulnerabilities.

@anulum
anulum merged commit 1275993 into main Sep 4, 2026
42 checks passed
@anulum
anulum deleted the anulum/actions-hygiene-20260904 branch September 4, 2026 08:08
This was referenced Sep 4, 2026
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@anulum