Repository navigation
A dependency refresh: an OSV scan of the lockfiles and the API's pom flagged 18 packages with published advisories at v5.1.1 and flags none at this tag, and nothing changes outside the manifests, the lockfiles, the version numbers and the documentation. The API's Spring Boot parent moves from 3.5.3 to 3.5.16, the newest 3.5 release, past GHSA-wwpq-f5c3-7hvx (fixed in 3.5.14); that advisory needs a local user on the same host to take over the ApplicationTemp directory, and the impact it describes runs through server.servlet.session.persistent, which the API does not set. The ETL's certifi moves from 2026.7.22 to 2026.10.19 past GHSA-6q48-6c7w-9gw2, which drops the emSign ECC Root CA - G3 root whose intermediates had compromised keys. This one does reach a shipped path: httpx builds its TLS context from the certifi bundle unless SSL_CERT_FILE or SSL_CERT_DIR is set, so the SEC EDGAR requests tradegraph-etl --live makes are checked against the new bundle.
The explorer's Angular packages move on two lines, because the framework and the CLI are released separately. The framework packages (common, compiler, compiler-cli, core, forms, platform-browser and router) move together from 22.1.5 to 22.2.1, the first 22.x release clear of the router advisories GHSA-ff3f-86qr-9cv3, GHSA-62vg-58rm-qff7 and GHSA-57xq-rjx2-v5xh. @angular/build and @angular/cli move together from 22.1.7 to 22.2.3, the first CLI release whose zod pin is fixed. Their exact pins take piscina from 5.2.0 to 5.3.2 (GHSA-67c8-pqhq-4rmx) and zod from 4.4.3 to 4.6.6 (GHSA-mrhx-c7xc-m3w5), and the CLI's MCP server now sits on @modelcontextprotocol/server 2.3.1, so @modelcontextprotocol/sdk 1.30.0 (GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-rvq5-wwqv-78pq) left the tree and took body-parser 2.3.0 (GHSA-27r3-jxmh-p828), proxy-addr 2.0.7 (GHSA-jqcg-44mw-7w3h), hono 4.13.7 (GHSA-5r4p-p66f-jhc7) and ip-address 10.7.0 (GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rxp7-6hxx-x8q5) with it. Every @angular/build 22.2 release pins vite 8.3.0, which is still affected by the five advisories flagged on the explorer's vite 8.1.5 (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22) and by GHSA-vfpm-58rq-9qcg as well, so explorer/package.json carries an npm override that sets vite to 8.3.3, the fixed release on the line the build pins. vitest and @vitest/mocker move from 4.1.11 to 4.1.12 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp), brace-expansion from 5.0.9 to 5.0.12 (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr), fast-uri from 3.1.7 to 3.1.9 (GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h), source-map-js from 1.2.1 to 1.2.2 (GHSA-68fv-2mgg-jv7q) and undici from 7.29.1 to 7.30.1 (GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472, GHSA-xjj6-f33q-929c). The lockfile marks twelve of these fourteen explorer packages as development dependencies of the Angular CLI and build, vitest and jsdom. The other two, @angular/router and zod, which comes in through @angular/forms, are production dependencies, but the explorer's source imports neither @angular/router nor @angular/forms, and its angular.json configures no server side rendering, which is where all three router advisories apply. That exposure was judged from the source and the lockfile, not from an inspection of the built bundle; the explorer image serves only the static files ng build writes to dist/explorer/browser.
The web demo's vite moves from 6.4.3 to 6.4.4, past the same five advisories, and its source-map-js from 1.2.1 to 1.2.2, both development dependencies. Every vite advisory in this release concerns the development server, two of them only on Windows, so none of them reaches the static files the demo or the explorer ship. npm run weight measures the demo at 844,919 bytes on disk and 241,422 gzipped under Node 22.23.3 with zlib 1.3.1-e00f703, the figures web/README.md already quotes. Nothing else landed on main after v5.1.1. Tests at this commit: 47 ETL pytest, 60 API unit and 34 Testcontainers integration, 9 explorer specs, and 135 browser demo self check assertions, all passing in CI run 40182648177 on the merge commit: https://github.com/SAY-5/tradegraph/actions/runs/40182648177