Skip to content

fix(deps): remediate Undici advisories #12513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rsliter wants to merge 4 commits into from
Closed

fix(deps): remediate Undici advisories #12513

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f773454
fix(deps): remediate Undici advisories
rsliter Sep 30, 2026
b0e98ce
merge: synchronize main
rsliter Sep 30, 2026
8d78201
fix(deps): record qualification and harden diagnostics
rsliter Sep 30, 2026
1dc162e
test(security): align redacted messaging diagnostics
rsliter Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 5 additions & 7 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,9 +65,7 @@ COPY tools/mcp-tool-discovery-runtime/reviewed-runtime-bundle/mcp-tool-discovery
FROM scratch AS managed-startup-runtime-builder
COPY tools/mcp-tool-discovery-runtime/reviewed-runtime-bundle/managed-startup-direct-image-runtime.bundle /out/managed-startup-image-runtime.cjs

# Fetch immutable reviewed archives outside RUN instructions. The protected
# GPU rebuild imports these checksum-addressed source records from the
# amd64 build cache, while every package-materialization RUN remains offline.
# Keep package materialization offline.
FROM scratch AS wechat-npm-archives

ADD --checksum=sha256:467e8047f7114e45944961fcd3eda9421843c9c65db61ea24176e252ab800ee4 https://registry.npmjs.org/@tencent-weixin/openclaw-weixin/-/openclaw-weixin-2.4.9.tgz /openclaw-weixin-2.4.9.tgz
Expand Down Expand Up @@ -522,7 +520,9 @@ ADD --chmod=0444 --checksum=sha256:f3fb42099ea7a0efa2753b3e770fa0d505714e1c7d75f
FROM scratch AS openclaw-managed-messaging-npm-common-archives-5

ADD --chmod=0444 --checksum=sha256:65834dc9ce7ecceff4334a14796c85960cbf665d09364698bf3196ceed04d677 https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz /uint8array-extras-1.5.0.tgz
ADD --chmod=0444 --checksum=sha256:93b3abe22a9d2858938b5f3829a9fd8952392348ffed9057662ae846e2e46d54 https://registry.npmjs.org/undici/-/undici-7.29.1.tgz /undici-7.29.1.tgz
ADD --chmod=0444 --checksum=sha256:9d72c56c17ad2b3d66f006d53945374cc0d2bc68f322439495b972269f4de6bc https://registry.npmjs.org/undici/-/undici-8.10.0.tgz /undici-8.10.0.tgz
ADD --chmod=0444 --checksum=sha256:740638ae32d78d2646a6727950e365fa26b6fa87913fa096e60ed4afeb4634aa https://registry.npmjs.org/undici/-/undici-8.10.2.tgz /undici-8.10.2.tgz
ADD --chmod=0444 --checksum=sha256:07a721cb2cd0dd798c24757de34d14e8b640ff8fddef85d662e00b392562a1f2 https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz /undici-types-8.3.0.tgz
ADD --chmod=0444 --checksum=sha256:e4bfbbe867144ff24f73198367479378c8b6cffc798a2ec0756a81097606908e https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.3.0.tgz /unicorn-magic-0.3.0.tgz
ADD --chmod=0444 --checksum=sha256:2dfb5e06d1d4bf1fe9f0fa7f633c4a2fde04d8b41cf0b9bd249a42561d5edfb6 https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz /unpipe-1.0.0.tgz
Expand Down Expand Up @@ -881,9 +881,7 @@ RUN test -f /usr/local/bin/node \
&& test -z "$node_unsafe" \
&& json5_unsafe="$(find -L /opt/nemoclaw/node_modules/json5 \( ! -user root -o -perm /022 \) -print -quit)" \
&& test -z "$json5_unsafe"
# Reviewed-archive invariants (#5896): the dedicated build stage materializes
# the committed lock, seeds resolver metadata, and re-packs every archive offline
# before this root-owned immutable cache enters the final image.
# Reviewed-archive invariants (#5896): immutable offline cache.
COPY --from=wechat-npm-cache /out/wechat-npm-cache/ /usr/local/share/nemoclaw/wechat-npm-cache/
COPY --from=openclaw-patch-payload / /

Expand Down Expand Up @@ -943,7 +941,7 @@ RUN --mount=type=secret,id=nemoclaw-mcporter-audit-receipt,required=false \
OPENCLAW_LOCK_SHA256=none-legacy-fixture; \
OPENCLAW_RECIPE='ignore-scripts+reviewed-lifecycle-v1'; \
if [ "$OPENCLAW_VERSION" = "2026.9.1" ]; then \
OPENCLAW_LOCK_SHA256=c015570ccccf56986c3d92a85de6f7aa507110f6a11cc2eedd80752672589f9b; \
OPENCLAW_LOCK_SHA256=71f87f397d8f628c40daefb0cc80d7b35a3be0353884f8275824a46568dc3113; \
ACTUAL_OPENCLAW_LOCK_SHA256="$(sha256sum /usr/local/lib/nemoclaw/openclaw-runtime/package-lock.json | awk '{print $1}')"; \
[ "$ACTUAL_OPENCLAW_LOCK_SHA256" = "$OPENCLAW_LOCK_SHA256" ] \
|| { echo "ERROR: OpenClaw lock SHA-256 mismatch (expected $OPENCLAW_LOCK_SHA256, found $ACTUAL_OPENCLAW_LOCK_SHA256)" >&2; exit 1; }; \
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -515,7 +515,7 @@ RUN --mount=type=bind,source=nemoclaw-blueprint/blueprint.yaml,target=/tmp/bluep
OPENCLAW_LOCK_SHA256=none-legacy-fixture; \
OPENCLAW_RECIPE='ignore-scripts+reviewed-lifecycle-v1'; \
if [ "$OPENCLAW_VERSION" = "2026.9.1" ]; then \
OPENCLAW_LOCK_SHA256=c015570ccccf56986c3d92a85de6f7aa507110f6a11cc2eedd80752672589f9b; \
OPENCLAW_LOCK_SHA256=71f87f397d8f628c40daefb0cc80d7b35a3be0353884f8275824a46568dc3113; \
ACTUAL_OPENCLAW_LOCK_SHA256="$(sha256sum /usr/local/lib/nemoclaw/openclaw-runtime/package-lock.json | awk '{print $1}')"; \
[ "$ACTUAL_OPENCLAW_LOCK_SHA256" = "$OPENCLAW_LOCK_SHA256" ] \
|| { echo "Error: OpenClaw lock SHA-256 mismatch (expected $OPENCLAW_LOCK_SHA256, found $ACTUAL_OPENCLAW_LOCK_SHA256)"; exit 1; }; \
Expand Down
22 changes: 22 additions & 0 deletions agents/openclaw/managed-image-messaging-runtime/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions agents/openclaw/managed-image-messaging-runtime/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@
"nemoclaw-openclaw-override-ip-address": "npm:ip-address@10.5.0",
"nemoclaw-openclaw-override-protobufjs": "npm:protobufjs@8.7.2",
"nemoclaw-openclaw-override-qs": "npm:qs@6.15.3",
"nemoclaw-openclaw-override-undici-7": "npm:undici@7.29.1",
"nemoclaw-openclaw-override-undici-8": "npm:undici@8.10.2",
"nemoclaw-openclaw-override-uuid": "npm:uuid@14.0.2",
"openclaw": "2026.9.1",
"undici": "8.10.0"
Expand Down
6 changes: 3 additions & 3 deletions agents/openclaw/openclaw-runtime/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion agents/openclaw/openclaw-runtime/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@
"overrides": {
"hono": "4.12.34",
"tar": "7.5.21",
"fast-uri": "3.1.7"
"fast-uri": "3.1.7",
"undici": "8.10.2"
},
"engines": {
"node": ">=22.22.3 <23 || >=24.15.0 <25 || >=25.9.0"
Expand Down
8 changes: 4 additions & 4 deletions ci/pi-agent-qualification-v1-linux-amd64.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
"agent": "pi",
"platform": "linux/amd64",
"image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
"digest": "sha256:2585d6f48d1a6d6c059b59e8c273fb08274b4e8af8ba9d0db59f0df45fc4f479",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:2585d6f48d1a6d6c059b59e8c273fb08274b4e8af8ba9d0db59f0df45fc4f479",
"digest": "sha256:ec5befc280f4869782952a4fb147e7f8321780db1887a3248accfe38e7e8b980",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:ec5befc280f4869782952a4fb147e7f8321780db1887a3248accfe38e7e8b980",
"source": {
"repository": "NVIDIA/NemoClaw",
"revision": "d60ee0bb36e582f83846f41a1b7e94719fcd89f6",
"revision": "b0e98ce714029f43ec8573c735cfbeed453ff219",
"release": "v0.1.0",
"cohort": "ghrun-36504446248-1"
"cohort": "ghrun-36661723135-1"
},
"startupProfileContractVersion": 1,
"capabilityContractVersion": 1
Expand Down
8 changes: 4 additions & 4 deletions ci/pi-agent-qualification-v1-linux-arm64.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@
"agent": "pi",
"platform": "linux/arm64",
"image": "ghcr.io/nvidia/nemoclaw/pi-sandbox",
"digest": "sha256:de600347e74f8bd4be17b572b079159f98037200477505c718b5b0f3f47b66fb",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:de600347e74f8bd4be17b572b079159f98037200477505c718b5b0f3f47b66fb",
"digest": "sha256:455a795a5c78abbc4ed3087f075ea545b394d58b7dbcd1768ac7c2713aa9d158",
"reference": "ghcr.io/nvidia/nemoclaw/pi-sandbox@sha256:455a795a5c78abbc4ed3087f075ea545b394d58b7dbcd1768ac7c2713aa9d158",
"source": {
"repository": "NVIDIA/NemoClaw",
"revision": "d60ee0bb36e582f83846f41a1b7e94719fcd89f6",
"revision": "b0e98ce714029f43ec8573c735cfbeed453ff219",
"release": "v0.1.0",
"cohort": "ghrun-36504446248-1"
"cohort": "ghrun-36661723135-1"
},
"startupProfileContractVersion": 1,
"capabilityContractVersion": 1
Expand Down
2 changes: 1 addition & 1 deletion ci/reviewed-npm-audit.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@
"integrity": "sha512-0Ve0631CdgkJDwd4NNG1BawIdF5yCL2sO+Tts8amStw+H6vKURTj0K4rOa4+hFpJk1Dnw5LyKl5twzwX1VtA2w==",
"tarballUrl": "https://registry.npmjs.org/openclaw/-/openclaw-2026.9.1.tgz",
"directory": "agents/openclaw/openclaw-runtime",
"lockSha256": "c015570ccccf56986c3d92a85de6f7aa507110f6a11cc2eedd80752672589f9b"
"lockSha256": "71f87f397d8f628c40daefb0cc80d7b35a3be0353884f8275824a46568dc3113"
},
{
"id": "mcporter-runtime",
Expand Down
8 changes: 4 additions & 4 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@
"qrcode-terminal": "^0.12.0",
"smol-toml": "1.8.0",
"typebox": "1.1.38",
"undici": "8.10.0",
"undici": "8.10.2",
"yaml": "2.8.3"
},
"optionalDependencies": {
Expand Down
Loading
Loading