chore(security): add dependabot config + close 14 open advisories#348
Merged
Conversation
….5.10 - Add .github/dependabot.yml covering npm (root, website, 3 integrations) + github-actions. Weekly cadence, grouped minor/patch, scoped commit prefixes. - Bump website next ^16.2.4 → ^16.2.6: closes 13 open advisories (middleware/proxy bypass, SSRF, DoS, CSP-nonce XSS, image-opt DoS, cache poisoning, beforeInteractive XSS, segment-prefetch routes). - Pin website postcss → ^8.5.10 via overrides: closes XSS via unescaped </style> in CSS stringify output (resolves to 8.5.14). Verified: - `npm audit --omit=dev` → 0 vulnerabilities. - `npm run build` clean on Next 16.2.6 (Turbopack).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR adds automated dependency management to the repository by introducing a Dependabot configuration that schedules weekly updates for npm packages across the root, website, and integration directories, plus GitHub Actions, with concrete version updates to the website's Next.js and postcss dependencies. ChangesDependency Automation Setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/dependabot.yml (1)
44-90: ⚡ Quick winConsider grouping minor/patch updates for integration directories.
The three integration configurations (openclaw, pi, filesystem-watcher) lack the
groupssection that is present in the root, website, and github-actions configurations. This inconsistency means minor and patch updates will create separate PRs for integrations instead of being grouped together, potentially increasing PR volume.For consistency and to reduce PR noise, consider adding the same grouping strategy:
📦 Proposed addition of groups to integration configs
For each integration block (openclaw, pi, filesystem-watcher), add after the
commit-messagesection:commit-message: prefix: deps(openclaw) include: scope + groups: + minor-and-patch: + update-types: + - minor + - patch🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 44 - 90, The three Dependabot npm entries for the integration directories (package-ecosystem: npm, directory: /integrations/openclaw, /integrations/pi, /integrations/filesystem-watcher) are missing a groups section; add the same grouping strategy used elsewhere so minor/patch updates are consolidated (e.g., add a groups entry after commit-message that groups "all-minor-patch" for type: dependency and update-types: [version-update:semver-minor, version-update:semver-patch] and any required patterns), ensuring each integration block uses identical group names and rules to match the root/website/github-actions configs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/dependabot.yml:
- Around line 44-90: The three Dependabot npm entries for the integration
directories (package-ecosystem: npm, directory: /integrations/openclaw,
/integrations/pi, /integrations/filesystem-watcher) are missing a groups
section; add the same grouping strategy used elsewhere so minor/patch updates
are consolidated (e.g., add a groups entry after commit-message that groups
"all-minor-patch" for type: dependency and update-types:
[version-update:semver-minor, version-update:semver-patch] and any required
patterns), ensuring each integration block uses identical group names and rules
to match the root/website/github-actions configs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: bb57d519-713b-417c-8536-b3b204aadca4
⛔ Files ignored due to path filters (1)
website/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
.github/dependabot.ymlwebsite/package.json
4 tasks
rohitg00
added a commit
that referenced
this pull request
May 15, 2026
…loy templates + Gemini GA bumps (#383) * chore(release): v0.9.13 — env-example discovery + CJK tokenizer + load harness + deploy templates + Gemini GA bumps + 14 advisories closed Six PRs landed since v0.9.12: - #372 .env.example discovery (this commit) — repo-root template + `init` CLI command + CI sync-checker - #362 CJK BM25 tokenizer (`@node-rs/jieba` + tiny-segmenter + Hangul) - #363 `benchmark/load-100k.ts` harness with p50/p90/p99 + per-release results dir - #361 one-click deploy templates for fly.io / Railway / Render / Coolify (multi-stage Dockerfile, `iiidev/iii` base, `gosu` privilege drop, first-boot HMAC, verified end-to-end on fly.io) - #364 Python ecosystem via `iii-sdk` example (replaces closed PR #360) - #370 Gemini GA bumps (LLM default → gemini-2.5-flash, embedding → gemini-embedding-001 + L2-norm + 768 dims) Plus 14 open Dependabot advisories closed in PR #348 via Next.js → 16.2.6 and PostCSS → 8.5.10 overrides. Bumped: - src/version.ts: VERSION 0.9.12 → 0.9.13 - package.json: 0.9.12 → 0.9.13, files += ".env.example", build script copies .env.example into dist/ - packages/mcp/package.json: 0.9.12 → 0.9.13 (lockstep with main) - plugin/.claude-plugin/plugin.json, plugin/.codex-plugin/plugin.json: 0.9.12 → 0.9.13 - src/types.ts: ExportData.version union extended with "0.9.13" - src/functions/export-import.ts: supportedVersions Set extended - test/export-import.test.ts: expected version updated New surface: - .env.example at repo root — every env var read by src/ documented in one place, grouped by surface (LLM, embedding, auth, search tuning, behaviour flags, CLI runtime, ports, iii engine pin, Claude Code bridge, Obsidian export). Every line commented out by default so the file is a template. - agentmemory init — copies bundled .env.example to ~/.agentmemory/.env if absent, refuses to overwrite, prints a diff command. Wired into CLI dispatch + help block. - scripts/check-env-example.mjs — walks src/ for env-read patterns, fails CI on drift in either direction. Plugged into ci.yml after npm test. Initial bootstrap: 60 keys in sync. Verified: npm test 903/903, npm run build clean, init smoke pass (creates ~/.agentmemory/.env on first run, refuses overwrite on second). * fix(init): atomic copy via COPYFILE_EXCL; address CodeRabbit review Two valid findings from the CodeRabbit pass on PR #383. 1. `runInit` race between existsSync(target) + copyFile(template, target). A parallel `agentmemory init` (or any other process touching ~/.agentmemory/.env between the two calls) would silently overwrite the config the operator just wrote. Switch to a single atomic `copyFile(template, target, fsConstants.COPYFILE_EXCL)` and treat the EEXIST error as the "already configured" signal — same warning + diff hint as before, but the check + copy now happen in one syscall so they cannot race. Other failure paths still surface as process exit 1. 2. Comment on `scripts/check-env-example.mjs::walk` claimed it matched ".ts / .mts / .mjs" but the regex also matched ".js". Rewrote the comment to match the regex (".ts / .mts / .mjs / .js"). Same comment pass: noted that test/ never enters because the walk is rooted at src/, not because of an explicit skip. Skipped findings: - WHAT-style comment on `findEnvExample` — kept a one-liner explaining the package-vs-source priority since both paths are real; reduced the block from 4 lines to 2 instead of removing it entirely. - "Add trailing newline to .env.example" — file already ends with `\n` (verified `tail -c 5` shows `tion\n`). Verified locally: - `npm run build` clean. - `npm test` 903 / 903 pass. - First `agentmemory init` against a clean HOME creates the file. - Second init against the same HOME hits EEXIST and prints the "leaving it untouched" warning + diff hint without overwriting. - `node scripts/check-env-example.mjs` — in sync (60 keys).
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/dependabot.yml(didn't exist before) covering all 5 npm manifests + github-actions, weekly cadence, grouped minor/patch.nextinwebsite/from^16.2.4→^16.2.6to close 13 open advisories spanning middleware/proxy bypass, SSRF on WebSocket upgrades, DoS via connection exhaustion, CSP-nonce XSS, image-opt DoS, RSC cache poisoning, beforeInteractive XSS, and segment-prefetch routes.postcssto^8.5.10(resolves to 8.5.14) viaoverridesinwebsite/package.jsonto close the XSS-via-unescaped-</style>advisory. postcss is transitive, so the override is the cleanest forced floor.Closes
Closes the 14 open Dependabot alerts on default branch:
Dependabot scope
Verification
npm audit --omit=devinwebsite/→ 0 vulnerabilities.npm run buildinwebsite/clean on Next 16.2.6 (Turbopack, 5 static pages generated).Test plan
Summary by CodeRabbit
Chores