fix(deps): bump agents to ^0.3.10 to drop x402/wallet dependency chain - #4
Open
CEJ98 wants to merge 1 commit into
Open
fix(deps): bump agents to ^0.3.10 to drop x402/wallet dependency chain#4CEJ98 wants to merge 1 commit into
CEJ98 wants to merge 1 commit into
Conversation
agents ^0.1.0 pulls in the Cloudflare Agents x402 payments stack (Coinbase CDP SDK, MetaMask SDK, WalletConnect, Solana kit) even though the bot never uses on-chain payments. Those wallet libraries drag in vulnerable axios/ws/uuid transitively. agents ^0.3.10 no longer depends on x402, which removes 417 unused packages and cuts pnpm audit findings tied to that chain from 28 to 12 (the remaining 12 are unrelated undici/@anthropic-ai/sdk/ @modelcontextprotocol/sdk/@hono/node-server advisories, unaffected by this bump). Verified: pnpm install, pnpm typecheck (clean), pnpm test (437/437 passing across 65 files).
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe package manifest updates the ChangesAgents dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué
Sube
agentsde^0.1.0a^0.3.10enpackage.json.Por qué
agents@0.1.x(Cloudflare Agents SDK) trae colgando el stack de pagos x402 —Coinbase CDP SDK, MetaMask SDK, WalletConnect, Solana kit— como dependencia
interna, aunque el bot nunca lo usa. Esas librerías de wallets arrastran
axios/ws/uuidcon vulnerabilidades conocidas.agents@0.3.10ya no depende de x402.Verificado (en este PR, con
pnpm install/pnpm audit/pnpm testsobre el repo real)pnpm audit— hallazgos totalespnpm audit— atribuibles a la cadena agents/x402/walletpnpm typecheckpnpm testLos 12 hallazgos que quedan después del bump son de
undici(víaai/@ai-sdk/*),@anthropic-ai/sdk,@modelcontextprotocol/sdky@hono/node-server— no tienenrelación con
agentsni con este bump, quedan fuera de alcance de este PR.Alcance
Solo
package.json+pnpm-lock.yaml. Sin cambios de código, sin refactor.Summary by CodeRabbit