Closed
Conversation
Bumps @nestjs/* to ^11.1.18 (direct, _example + agent devDeps), axios to ^1.15.0 (forest-cloud), and adds Yarn resolutions for transitive vulns: follow-redirects >=1.16.0, lodash/lodash-es >=4.18.0, hono >=4.12.14, @hono/node-server ^1.19.13, langsmith >=0.5.19.
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
16 fixed, 0 ignored, 9 deferred, 7 resolutions added.
Bumps
@nestjs/*(direct dep, _example + agent devDeps) andaxios(forest-cloud direct dep) to patched versions, plus Yarnresolutionsfor transitive vulnerabilities that have no reachable parent bump in the tree.Fixed
packages/forest-cloud^1.13.5→^1.15.0resolutions:>=1.16.0(transitive viaforest-cloud#axios)resolutions:>=0.5.19(transitive viaai-proxy#@langchain/core)resolutions:>=4.18.0(transitive, many parents)resolutions:>=4.18.0(same bump as #324)resolutions:>=4.12.14(transitive via@modelcontextprotocol/sdk)resolutions:^1.19.13(transitive via@modelcontextprotocol/sdk)packages/_example^10.4.16→^11.1.18packages/agent^10.4.16→^11.1.18packages/_example^10.4.16→^11.1.18resolutions:>=4.18.0(transitive via@qiwi/multi-semantic-release)Ignored
None.
Deferred
Skipped by the 7-day age gate (created less than 7 days ago at 2026-04-22 12:55 UTC):
Resolutions added
Seven entries added to the root
resolutionsblock. For each, the nearest ancestor in the dep graph could not pull in the patched sub-dep, so a scoped pin was used.follow-redirectspinned to>=1.16.0. Parent chain attempted:forest-cloud#axios#follow-redirects.axios@^1.15.0still declaresfollow-redirects "^1.15.11", which keeps 1.15.11 resolvable; the only way to force ≥1.16.0 was a resolution. Unblock later: drop the pin whenaxiospublishes a release declaringfollow-redirects≥1.16.0.langsmithpinned to>=0.5.19. Parent chain attempted:ai-proxy#@langchain/core#langsmithandai-proxy#@langchain/community#@langchain/classic#langsmith.@langchain/core@1.1.15(the exact-pinned version inai-proxy) declareslangsmith ">=0.4.0 <1.0.0"and@langchain/classicrepeats the same range, so yarn happily kept 0.5.11. Bumping@langchain/coreitself would be a pin change with a broader API-surface risk than the scoped resolution. Unblock later: when@langchain/corepublishes a release raising itslangsmithfloor, drop the pin.lodashpinned to>=4.18.0. Parent chains attempted: 15+ ancestors (lerna, sequelize, inquirer, jsonapi-serializer, markdown-link-check, forest-cli, @commitlint, @semantic-release/*, prettier-eslint/vue-eslint-parser, ip-address, @oclif/plugin-warn-if-update-available). All of them declarelodash "^4.17.x"; 4.18 is still on the 4.x line, so the range accepts it, but no ancestor release yet forces it. Bumping every ancestor individually is not viable (many are infrequently-released CLI tooling). A root resolution is the smallest blast radius. Unblock later: drop the pin once the major ancestors (lerna, sequelize, forest-cli, semantic-release plugins) ship releases withlodash "^4.18.0".lodash-espinned to>=4.18.0. Parent chain attempted:@qiwi/multi-semantic-release#semantic-release#@semantic-release/{commit-analyzer,github,npm,release-notes-generator}#lodash-es. All four@semantic-release/*plugins declarelodash-es "^4.17.21"and have not released a version raising the floor; bumping@qiwi/multi-semantic-releasedoes not close it either. Unblock later: drop when@semantic-release/*plugins ship a release withlodash-es "^4.18.0".honopinned to>=4.12.14. Parent chain attempted:ai-proxy#@langchain/mcp-adapters#@modelcontextprotocol/sdk#hono(also surfaced via@modelcontextprotocol/sdkused directly bymcp-serverthrough@langchain/mcp-adapters).@modelcontextprotocol/sdkdeclareshono "^4.11.4"; 4.12.14 is within that range but the SDK has not re-published to force it. No single ancestor version exists that requires ≥4.12.14. Unblock later: drop when@modelcontextprotocol/sdkbumps itshonofloor.@hono/node-serverpinned to^1.19.13. Parent chain attempted:ai-proxy#@langchain/mcp-adapters#@modelcontextprotocol/sdk#@hono/node-server. Same shape as chore(datasource sequelize): refactor QueryConverter #322–chore(example): re add mongoose datasource inside example #318. Initially tried>=1.19.13, which resolved to 2.0.0 (major), so tightened to^1.19.13to stay on the 1.x line consumed by@modelcontextprotocol/sdk(^1.19.9). Unblock later: drop when MCP SDK bumps its floor or supports 2.x.axiosalso pinned at the root to>=1.15.0. The forest-cloud direct bump is enough on its own for the declared dependency, but a root resolution guarantees any hoisted/transitiveaxios(e.g.lerna#nx#axios) also lands on 1.15.x, closing the same advisory at the graph level. Unblock later: this is redundant once every transitive axios consumer advertises^1.15.0or higher; safe to remove at that point.Risks
@nestjs/core+ siblings 10.4.20 → 11.1.19 (major). This is the only breaking bump in this PR. It touches two places:packages/_example(a private, non-published example app:NestFactory.create,FastifyAdapter,@Controller,@Module,@Get— all stable across v10 → v11) andpackages/agentdevDependencies (used only by two integration tests:test/framework-mounter.test.tsandtest/agent-integration.test.ts, same API surface). The cascade from this bump pulled Fastify 4 → 5, Express 4 → 5,@fastify/cors9 → 11,@fastify/formbody7 → 8,find-my-way8 → 9,pino→ 10,multer1 → 2, and some peer-adjacent plugins into their 5.x line. All 901 tests in@forestadmin/agentpass, including the NestJS integration tests, so the agent's own runtime surface is unaffected (it doesn't ship NestJS — only tests against it). Consumers are unaffected because@nestjs/*are dev-only for the published@forestadmin/agentpackage.axios1.13.5 → 1.15.2. Patch line of 1.x; no changelog-listed breaking changes touching APIs used by forest-cloud (justaxios.create,axios.get/post/patch/delete, response/interceptor plumbing). No behavior change beyond the patched SSRF + metadata-exfiltration vulns.follow-redirects1.15.11 → 1.16.0,lodash4.17.23 → 4.18.1,lodash-es4.17.23 → 4.18.1,hono4.12.9 → 4.12.14,@hono/node-server1.19.12 → 1.19.14,langsmith0.5.11 → 0.5.21. All minor/patch bumps on the same semver line. No behavior change beyond the patched vulns.mainare unaffected by this PR and equivalent betweenmainand this branch (yarn testfrom root on baseline: 1222 integration-test failures; on this branch: 1215 — all pre-existing DB/network-dependent).Manual testing
Covered by CI — no manual steps needed. Verified locally via
yarn workspace @forestadmin/agent test(901/901 pass, covers the NestJS bump),yarn workspace @forestadmin/forest-cloud test(162/162, covers the axios bump),yarn workspace @forestadmin/ai-proxy test(274/274, covers langsmith/hono resolutions),yarn workspace @forestadmin/mcp-server test(540/540, covers hono/@hono/node-server resolutions), andyarn workspace @forestadmin/agent-testing test(33/33).Validation
yarn workspace @forestadmin/agent test: 901 passed.yarn workspace @forestadmin/forest-cloud test: 162 passed.yarn workspace @forestadmin/ai-proxy test: 274 passed (41 skipped, same as main).yarn workspace @forestadmin/mcp-server test: 540 passed.yarn workspace @forestadmin/agent-testing test: 33 passed (1 skipped, same as main).yarn build(all 20 projects): success.npx prettier --checkon every file touched by this PR: clean. (Root-levelnpx prettier --check .shows 45 pre-existing style warnings, unchanged betweenmainand this branch.)yarn lint: pre-existing errors indatasource-mongo/src/connection/create-connection.tsonly, identical onmain.yarn whyafter install confirms patched versions resolved everywhere: axios 1.15.2, follow-redirects 1.16.0, lodash 4.18.1, lodash-es 4.18.1, hono 4.12.14, @hono/node-server 1.19.14, langsmith 0.5.21, @nestjs/core 11.1.19.https://claude.ai/code/session_01SV4RdAPN73FmbhMrqfsPHM
Note
Patch 16 Dependabot security alerts by upgrading NestJS, axios, and other dependencies
@nestjs/*packages from^10.4.16to^11.1.18in the example app and agent packagesaxiosconstraint from^1.13.5to^1.15.0inpackages/forest-cloudpackage.jsonforfollow-redirects,lodash,lodash-es,hono,@hono/node-server, andlangsmithto satisfy Dependabot alertsMacroscope summarized 4ec7b0b.