Repository navigation
chore(deps)!: patch critical/high vulnerabilities and drop Node 20 - #33
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
Collaborator
Author
|
@SocketSecurity ignore-all |
matallui
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Problem
The committed dependency tree includes critical Tinypool findings and high-severity findings across runtime and development packages. The existing Node range also accepts Node 20 and older, unpatched Node 22/24 releases.
The October Node security release fixes DNS, TLS, and Brotli vulnerabilities. Node rates the highest severity as high, including the Brotli remote-code-execution issue, CVE-2026-111497.
Changes
sdk-nodeto^0.220.0and resources to^2.9.0. This supplies patched Jaeger propagation and removes the vulnerableprotobufjs8.x dependency.2.1.0 → 2.1.2and Undici8.5.0 → 8.12.3. Their parents pin the vulnerable versions exactly.22.23.4and24.22.1, and.nvmrcto24.22.1. Update Node types, documentation, and Docker examples. Remove the Node-20-only coverage exception and an obsolete lint suppression.flowchart TD A[Open critical and high alerts] --> B[Resolve patched dependency versions] B --> C[Replace vulnerable exact pins] C --> D[Apply patched Node minimums] D --> E[Audit locked and fresh dependency trees] E --> F[Build and test on Node 22.23.4 and 24.22.1] classDef new fill:#fff3cd,stroke:#d39e00 class B,C,D newYellow boxes are new.
What changes
22.23.4; CI tests that release24.22.1; CI tests that releaselts/*24.22.1The Node minimum change affects consumers on older runtimes. CI now measures the full coverage thresholds on both supported LTS releases.
Decisions for reviewers
tarandzodpatchesReview guide
package.jsonyarn.lock.github/workflows/build-lint-test.yml,.nvmrcvitest.config.mts, pi adapter/runtime, test fixturesREADME.md, Docker integration fixtureSecurity package inventory
@grpc/grpc-js1.14.31.14.6@opentelemetry/propagator-jaeger2.7.12.9.0brace-expansion1.1.14,2.1.0,5.0.61.1.21,2.1.7,5.0.12browserslist4.28.24.29.4js-yaml3.14.2,4.1.13.15.2,4.3.2linkify-it5.0.05.0.2markdown-it14.1.114.3.3postcss8.5.148.5.31protobufjs8.0.1, plus7.6.68.0.1removed;7.6.6remainssource-map-js1.2.11.2.2tinypool2.1.02.1.2undici6.25.0,8.5.06.29.1,8.12.3vite8.0.118.3.5tar7.5.157.5.22zod4.5.44.6.7Dependabot alert numbers checked: 151, 150, 149, 148, 147, 143, 142, 137, 136, 135, 125, 124, 122, 118, 102, 98, 97, 90, 88, 82, 81, 64, 63, 61, 58, 57, 56, 49, 45, 42, 17, 16, 7, 5, 4, 3.
GitHub closes alerts after the fixed lockfile reaches the default branch. The branch check compares every resolved package version against each alert's vulnerable range.
Testing
24.22.1:yarn typecheck,yarn lint,yarn build, andCI=true yarn testpass.22.23.4:yarn typecheck,yarn build, andCI=true yarn testpass.YARN_ENABLE_IMMUTABLE_INSTALLS=false, then runyarn allow-scripts, high-severity audit, and the full suite. All pass; 653 tests pass, four skip. Restore the reviewed lockfile afterward.yarn install --immutableandyarn allow-scriptspass with the reviewed lockfile. Existing denied lifecycle scripts remain denied.yarn npm audit --all --recursive --severity high --jsonreports no findings for either dependency tree.git diff --checkpasses.Docker smoke tests remain skipped: the local Docker daemon is unavailable. Protocol fixtures and real in-memory telemetry export are covered by the suite.
References
taradvisoryzodadvisoryChecklist