ci(deps): OSV 批次 2026-08 —— undici 7.29.0 / hono 4.12.34 / fast-uri 3.1.5,把 main 上永远红的共享门禁修绿 (#5032) by xuyushun441-sys · Pull Request #5052 · objectstack-ai/objectstack

xuyushun441-sys · 2026-08-04T01:05:35Z

这批公告是什么

8 条公告(2 High、6 Medium)命中 origin/main lockfile 里已解析的 4 个 package@version,每一条都给出了修复版本,所以走升级、不走豁免:

公告	CVSS	package	原解析版本	修复版本
GHSA-7p8r-x3mc-p8w7	7.5	`fast-uri`	3.1.4	3.1.5
GHSA-8j4g-w8fx-2239	5.3	`hono`	4.12.32	4.12.34
GHSA-8j4g-w8fx-2239	5.3	`hono`	4.12.33	4.12.34
GHSA-4cwx-7wf7-3272	7.4	`undici`	7.28.0	7.29.0
GHSA-8xcm-r25x-g524	4.8	`undici`	7.28.0	7.29.0
GHSA-jr45-8vmc-qm54	5.9	`undici`	7.28.0	7.29.0
GHSA-m8rv-5g2x-5cg5	4.2	`undici`	7.28.0	7.29.0
GHSA-v3r7-h72x-cjcm	4.8	`undici`	7.28.0	7.29.0

Validate Package Dependencies 的 OSV-Scanner step 直接扫 pnpm-lock.yaml,命中即 exit 1。红在 main 自己身上,于是每个碰 manifest / lockfile 的 PR 都白背一条红(#5027 上实测,那个 PR 的 lockfile 增量只有三行、没解析出任何新包)。永远红的门禁比没有门禁更糟:下一个真的引入了脆弱依赖的 PR,在列表里长得和其它 PR 一模一样。

三个包各自的改法

undici —— 又一次踩中 #4945 那个坑。 原有的 pin(undici@>=7.23.0 <7.28.0 → ^7.28.0,当初为 GHSA-vmh5-mc38-953g 加的)恰好停在 7.28.0,而这 5 条新公告影响的正是 7.28.0;开区间上界不再覆盖它自己钉出来的版本,override 就在那儿空转。所以区间上界与 target 必须一起移动,抬到 <7.29.0 / ^7.29.0 —— 和 brace-expansion 5.0.8 → 5.0.9(#4961)是同一形状,我在 pnpm-workspace.yaml 的注释里把这个复发陷阱写明了。纯传递依赖(@vscode/vsce → cheerio),而 @ai-sdk/provider-utils 本来就解析 7.29.0,所以两份 dedupe 成一份;jsdom 的 undici 8.9.0 在 selector 之外,未受影响。

fast-uri —— 纯传递依赖,经 ajv@8.20.0(声明 ^3.0.1)进来,下游是 @modelcontextprotocol/sdk / @objectstack/objectql / secretlint / table。一条 fast-uri@<3.1.5 → ^3.1.5 覆盖全部。

hono —— 本批唯一不是纯传递的一个,也是这个 changeset 会发版的原因。两个版本同时在树上:4.12.32 来自我们自己的包,4.12.33 由 @modelcontextprotocol/sdk 拉入。override 负责搬动传递的那份,声明范围同步抬到 ^4.12.34(plugin-hono-server 的 dependency,加上 @objectstack/hono 与 plugin-auth 的 devDependency)—— overrides 不随已发布包出厂,声明范围如果留在旧值,下游装到的就是 CI 从未跑过的版本,这正是 check-override-consistency.mjs 存在的理由(它现在覆盖 2 条声明,绿)。

@objectstack/hono 的 peer 范围刻意保持宽松的 ^4.12.8:peer 说的是"这个 adapter 能配合哪个宿主 hono 工作",宿主自己钉了旧版就由宿主拥有那份副本;收窄它在本单里修不好任何东西,只会砍掉兼容性。

验证 —— 用 workflow 钉住的同一个 scanner

本容器 egress 拦 api.osv.dev,故按 #4961 的做法用真实二进制 + 离线库(osv-scanner_linux_amd64 v2.3.8,与 workflow 的 action v2.3.8 同版本):

修复前(与 issue 里贴的 CI 输出逐字一致):

Scanned .../pnpm-lock.yaml file and found 1502 packages
Total 4 packages affected by 8 known vulnerabilities (0 Critical, 2 High, 6 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
8 vulnerabilities can be fixed.
EXIT=1

修复后(已含 #5036 落地的 osv-scanner.toml,且该文件零豁免 —— 绿是真升级换来的,不是被过滤掉的):

Scanned .../pnpm-lock.yaml file and found 1500 packages
Loaded filter from: /home/user/objectstack-issue-5032/osv-scanner.toml
Loaded npm local db from /root/.cache/osv-scanner/npm/all.zip

No issues found
EXIT=0

该 job 的其余 step 全部照原样本地跑过(含 #5036 新增的那条):

pnpm install --frozen-lockfile --prefer-offline   → Done in 3s
node scripts/check-changeset-fixed.mjs            → ✓ fixed group 与 69 个 public 包同步
node scripts/check-override-consistency.mjs       → ✓ 2 published-manifest declaration(s) … 全部解析到 override target
node scripts/check-osv-exemptions.mjs --self-test → ✓ self-test passed
node scripts/check-osv-exemptions.mjs             → ✓ osv-scanner.toml holds zero OSV exemptions

pnpm why 前后对照:

package	before	after
`hono`	`Found 2 versions`(4.12.32 我们的包 / 4.12.33 经 MCP SDK)	`Found 1 version` → 4.12.34
`fast-uri`	`Found 1 version` → 3.1.4	`Found 1 version` → 3.1.5
`undici`	7.28.0(cheerio)、7.29.0(ai-sdk)、8.9.0(jsdom)	7.28.0 消失,cheerio 与 ai-sdk 并到 7.29.0;jsdom 8.9.0 不动

构建与受影响包的测试(全部在共享 verify 锁内、限堆跑,已 merge 当前 main 后重跑一遍):

pnpm build --concurrency=2   → Tasks: 71 successful, 71 total   (exit 0)
pnpm --filter {plugin-hono-server,hono,plugin-auth,client,mcp,connector-mcp,objectql} test → exit 0
    plugin-hono-server  13 files / 150 tests passed
    plugin-auth         29 files / 658 tests passed
    hono(adapter)        2 files /  73 tests passed
    client              17 files / 222 tests passed
    mcp                  8 files /  83 tests passed
    connector-mcp        3 files /  23 tests passed
    objectql           113 files / 1793 tests passed
pnpm --filter <同上> typecheck → exit 0

范围

严格限于 #5032 列的这 8 条。#4965(无修复版本的公告该怎么表达)是另一个议题,刚由 #5036 落地了 osv-scanner.toml 的三条约定 —— 本批每条都有修复版,按那份约定的原话就该"take the fix",所以本 PR 不新增任何 [[IgnoredVulns]]。改动面:pnpm-workspace.yaml + 3 个 manifest 的 hono 范围 + pnpm-lock.yaml + 1 个 changeset。packages/spec/**、metadata-protocol/src/protocol.ts、content/docs/releases/ 零改动。

一处需要维护者知情的撞车

本单有两条认领评论(00:39:44 本 session session_01NrmBxj8rK2uGCnh9aipjwX,00:40:04 另一 session session_018iARDqtrhQgz6fVHDeDkbQ 的分支 claude/issue-osv-fast-uri-hono-undici)。按 AGENTS.md「认领评论时间戳先者优先」的判据由本 session 实施;推送前再查一次,origin 上不存在该分支、也没有针对这批公告的其它 PR。若那边已有更完整的在飞改动,请直接关掉本 PR —— lockfile 是全仓最易冲突的单文件,两份并行改动比任何一份都糟。

Generated by Claude Code

….1.5 (#5032) Eight advisories (2 high, 6 medium) matched packages resolved in main's pnpm-lock.yaml, and all eight name a fixed version, so this is an upgrade and not an exemption (the osv-scanner.toml route #4965 just defined is for advisories with NO fix). The OSV-Scanner step reads the lockfile directly and exits non-zero on any match, so `Validate Package Dependencies` was red on main itself and attached that red to every PR touching a manifest or the lockfile. undici repeats the trap #4945 taught: the existing pin (undici@>=7.23.0 <7.28.0: ^7.28.0, added for GHSA-vmh5-mc38-953g) had settled on 7.28.0 — the version these five advisories affect — and its exclusive upper bound no longer covered it, so the override sat there doing nothing. Selector and target move together to <7.29.0 / ^7.29.0. Transitive-only via @vscode/vsce > cheerio; @ai-sdk/provider-utils already resolved 7.29.0 so the two dedupe. jsdom's undici 8.9.0 is outside the selector and untouched. fast-uri is transitive-only through ajv@8.20.0 (declares ^3.0.1) reaching @modelcontextprotocol/sdk, objectql, secretlint and table. hono is the one that is not transitive-only: 4.12.32 from our own packages and 4.12.33 pulled by @modelcontextprotocol/sdk. The override moves the transitive copy and the declared ranges move with it (plugin-hono-server dependency, plus the @objectstack/hono and plugin-auth devDependencies) — overrides do not ship with published packages, so a range left behind means downstream resolves a version CI never ran. The @objectstack/hono PEER range stays the permissive ^4.12.8 on purpose: a peer states which host hono the adapter works against. After the bump the workspace resolves one hono@4.12.34, one fast-uri@3.1.5, and no undici@7.28.0. Verified with the workflow's own scanner (osv-scanner v2.3.8, offline OSV db): 8 findings / exit 1 before, "No issues found" / exit 0 after, with osv-scanner.toml holding zero exemptions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrmBxj8rK2uGCnh9aipjwX

vercel · 2026-08-04T01:05:42Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 4, 2026 1:05am

github-actions · 2026-08-04T01:05:57Z

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/hono, @objectstack/plugin-auth, @objectstack/plugin-hono-server.

13 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

content/docs/deployment/cli.mdx (via @objectstack/plugin-auth)
content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
content/docs/deployment/vercel.mdx (via @objectstack/hono)
content/docs/getting-started/your-first-project.mdx (via @objectstack/plugin-hono-server)
content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth, @objectstack/plugin-hono-server)
content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
content/docs/plugins/index.mdx (via @objectstack/plugin-auth, @objectstack/plugin-hono-server)
content/docs/plugins/packages.mdx (via @objectstack/hono, @objectstack/plugin-auth, @objectstack/plugin-hono-server)
content/docs/protocol/kernel/http-protocol.mdx (via @objectstack/plugin-hono-server)
content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth, @objectstack/plugin-hono-server)
content/docs/releases/v16.mdx (via @objectstack/plugin-hono-server)
content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

Picks up caf144a (#5052, Fixes #5032) so 'Validate Package Dependencies' re-runs against the repaired base (undici 7.29.0 / hono 4.12.34 / fast-uri 3.1.5). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015W6nhsDrz6zWQc8je12a1t

github-actions Bot added size/s documentation Improvements or additions to documentation dependencies Pull requests that update a dependency file tooling labels Aug 4, 2026

xuyushun441-sys mentioned this pull request Aug 4, 2026

Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032

Closed

xuyushun441-sys marked this pull request as ready for review August 4, 2026 01:27

xuyushun441-sys added this pull request to the merge queue Aug 4, 2026

Merged via the queue into main with commit caf144a Aug 4, 2026
25 checks passed

xuyushun441-sys deleted the claude/issue-5032-osv-fixable-bumps branch August 4, 2026 01:34

claude Bot mentioned this pull request Aug 4, 2026

[PM] 分片分工登记表 — 谁在管哪个仓库的队列 #4604

Open

xuyushun441-sys mentioned this pull request Aug 4, 2026

docs(pm-dispatch,os-dev): 认领、查重、标签与验证方法论纪律修订 —— 用本周期三起真实事故固化 (#5166) #5174

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(deps): OSV 批次 2026-08 —— undici 7.29.0 / hono 4.12.34 / fast-uri 3.1.5,把 main 上永远红的共享门禁修绿 (#5032) - #5052

ci(deps): OSV 批次 2026-08 —— undici 7.29.0 / hono 4.12.34 / fast-uri 3.1.5,把 main 上永远红的共享门禁修绿 (#5032)#5052
xuyushun441-sys merged 1 commit into
mainfrom
claude/issue-5032-osv-fixable-bumps

xuyushun441-sys commented Aug 4, 2026

Uh oh!

vercel Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

xuyushun441-sys commented Aug 4, 2026

这批公告是什么

三个包各自的改法

验证 —— 用 workflow 钉住的同一个 scanner

范围

一处需要维护者知情的撞车

Uh oh!

vercel Bot commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

📓 Docs Drift Check

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants