Repository navigation
security: open Dependabot alerts #1442
Description
Tracking issue for open Dependabot security alerts, maintained by the weekly security-dependency job.
Last updated: 2026-11-09 (16 open alerts)
| Alert | Severity | GHSA | Package | Manifest | Fixed in | Status |
|---|---|---|---|---|---|---|
| #44 | high | GHSA-f897-62hf-6gxq | @modelcontextprotocol/sdk | packages/opencode/package.json | 1.30.1 | Fix in PR #1443 (1.29.0 → 1.32.2) |
| #43 | high | GHSA-46jr-4wx8-v453 | @modelcontextprotocol/sdk | packages/opencode/package.json | 1.32.0 | Fix in PR #1443 (1.29.0 → 1.32.2) |
| #40 | high | GHSA-22jm-h49p-29qw | @modelcontextprotocol/sdk | packages/opencode/package.json | 1.32.0 | Fix in PR #1443 (1.29.0 → 1.32.2) |
| #39 | high | GHSA-6qxp-vccf-f47h | @modelcontextprotocol/sdk | packages/opencode/package.json | 1.31.0 | Fix in PR #1443 (1.29.0 → 1.32.2) |
| #10 | high | GHSA-3ppc-4f35-3m26 | minimatch | packages/opencode/package.json | 10.2.1 | Fix in PR #1443 (10.0.3 → 10.2.5) |
| #11 | high | GHSA-23c5-xmqv-rm74 | minimatch | packages/opencode/package.json | 10.2.3 | Fix in PR #1443 (10.0.3 → 10.2.5) |
| #12 | high | GHSA-7r86-cg39-jmmj | minimatch | packages/opencode/package.json | 10.2.3 | Fix in PR #1443 (10.0.3 → 10.2.5) |
| #36 | high | GHSA-7r86-cg39-jmmj | minimatch | package.json | 10.2.3 | Fix in PR #1443 (10.0.3 → 10.2.5) |
| #42 | medium | GHSA-rvq5-wwqv-78pq | @modelcontextprotocol/sdk | packages/opencode/package.json | 1.32.0 | Fix in PR #1443 (1.29.0 → 1.32.2) |
| #41 | medium | GHSA-6prh-2h8m-c8cw | @modelcontextprotocol/sdk | packages/opencode/package.json | 1.32.0 | Fix in PR #1443 (1.29.0 → 1.32.2) |
| #38 | medium | GHSA-qqj6-54q6-cxv6 | snowflake-sdk | packages/drivers/package.json | 3.3.0 | Fix in PR #1443 (2.4.3 → 3.3.0) |
| #33 | medium | GHSA-hhx9-57xq-r5rw | @hey-api/openapi-ts | packages/sdk/js/package.json | 0.97.3 | Open: needs an SDK codegen migration (see below) |
| #29 | medium | GHSA-hcf7-66rw-9f5r | turbo | package.json | 2.9.14 | Fix in PR #1443 (2.8.13 → 2.9.14) |
| #28 | low | GHSA-3qcw-2rhx-2726 | turbo | package.json | 2.9.14 | Fix in PR #1443 (2.8.13 → 2.9.14) |
| #37 | low | GHSA-866g-f22w-33x8 | @ai-sdk/provider-utils | packages/core/package.json | 4.0.33 | Fix in PR #1443 (4.0.23 → 4.0.33, plus an overrides entry for the 4.0.21/4.0.27 transitive copies) |
| #32 | low | GHSA-4x5r-pxfx-6jf8 | @babel/core | packages/opencode/package.json | 7.29.6 | Fix in PR #1443 (7.28.4 → 7.29.6) |
Status
PR #1443 was rebuilt on main @ 3aa43a8 on 2026-11-09 and now fixes 15 of the 16 alerts. The Devin git proxy still returns 403 for this repo, so the job pushed the branch through the GitHub Git Data API instead. If the proxy is not fixed, future runs will do the same.
Left open
- docs: rewrite README for open-source launch #33
@hey-api/openapi-ts0.90.10 → 0.97.3 (dev-only SDK codegen). The vulnerablebuildClientParamstemplate is copied intopackages/sdk/js/src/v2/gen/core/params.gen.ts, so the SDK has to be regenerated. Under 0.97.3 the post-codegen patch inpackages/sdk/js/script/build.tsfails, because itsServerSentEventsResult<TData, TError>needle no longer exists. The@hey-api/sdkinstanceoption is also deprecated in favour ofoperations: { strategy: "single", containerName: "OpencodeClient", methods: "instance" }, and the regeneratedsrc/v2/gendiffers by ~18k lines. This needs its own PR.
Superseded Dependabot PRs
- chore(deps): bump minimatch from 10.0.3 to 10.2.3 #1185 (minimatch 10.2.3), chore(deps-dev): bump turbo from 2.8.13 to 2.10.9 #1104 (turbo 2.10.9), chore(deps): bump @ai-sdk/provider-utils from 4.0.23 to 4.0.33 in /packages/core #1277 (@ai-sdk/provider-utils 4.0.33): superseded by PR fix(deps): patch 15 Dependabot security alerts #1443.
- chore(deps): bump @modelcontextprotocol/sdk from 1.29.0 to 1.32.0 in /packages/opencode #1571 (@modelcontextprotocol/sdk 1.32.0): superseded by PR fix(deps): patch 15 Dependabot security alerts #1443, which also re-creates the bun patch for 1.32.2.
Activity
fix(deps): patch 15 Dependabot security alerts