Skip to content

chore(deps): bump mermaid to 11.16.1 and js-yaml to 4.3.1 to clear open Dependabot alerts #6375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 1 commit into from
Aug 7, 2026
Merged

chore(deps): bump mermaid to 11.16.1 and js-yaml to 4.3.1 to clear open Dependabot alerts #6375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/sim/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,13 +181,13 @@
"isolated-vm": "6.1.2",
"jose": "6.0.11",
"js-tiktoken": "1.0.21",
"js-yaml": "4.3.0",
"js-yaml": "4.3.1",
"jsdom": "^26.0.0",
"jszip": "3.10.1",
"lib0": "0.2.117",
"lru-cache": "11.3.6",
"mammoth": "^1.9.0",
"mermaid": "11.15.0",
"mermaid": "11.16.1",
"micromatch": "4.0.8",
"monaco-editor": "0.55.1",
"mongodb": "6.19.0",
Expand Down
20 changes: 14 additions & 6 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

52 changes: 10 additions & 42 deletions bunfig.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,48 +5,16 @@ exact = true
minimumReleaseAge = 604800
# @typescript/native-preview stays excluded permanently: it only publishes nightly
# dev builds, so every version is structurally younger than any age gate.
# The exactly pinned Pi 0.80.10 packages were vetted for the cloud-review SDK
# migration; they age out of the gate on 2026-07-24 — drop these four entries then.
# next@16.2.12, @next/env@16.2.12 and the @next/swc-* binaries carry the July 2026 security
# advisories (SSRF, cache confusion, DoS, middleware bypass — GHSA-89xv-2m56-2m9x et al.,
# fixed in 16.2.11) plus the TypeScript 7 support backport (vercel/next.js#95831) that
# 16.2.11 lacks — this repo resolves typescript to 7.x, and on 16.2.11 `next build`'s
# type-check step can die with a silent SIGSEGV because the legacy TS JS API is gone in TS7.
# Published 2026-07-25, they age out of the gate on 2026-08-01 — drop these entries then,
# and re-date this note on any further bump rather than deleting the entries early: removing
# them while the pinned version is still inside the 7-day window blocks the bump outright.
# The swc binaries ship in lockstep with next and
# MUST be excluded alongside it: they are next's platform-gated optionalDependencies, so
# gating them out leaves them absent from bun.lock entirely, and `bun install
# --frozen-lockfile` then installs no compiler at all — next falls back to downloading one
# at build time, which fails in CI.
# @anthropic-ai/sdk is exactly pinned to 0.114.0, vetted for the agent-events
# streaming work (adaptive thinking display types + transform-json-schema);
# published 2026-07-23, it ages out of the gate on 2026-07-30 — drop this entry then.
# @e2b/code-interpreter (2.7.0, published 2026-07-23) and its `e2b` dependency
# (2.36.1, published 2026-07-27) carry the fix for Pi's Create PR runs dying mid-stream
# with "protocol error: received unsupported compressed output": e2b 2.36.0 moved envd's
# Connect transport off the 2.0.0-rc.3 connect-web and onto undici 8 for Node >= 22.19.0,
# which is this app's engine floor. Only these two are excluded — the rest of the chain
# (@connectrpc/connect{,-web} 2.1.2, @bufbuild/protobuf 2.13.0, undici 8.8.0) already
# clears the gate, and `tar` resolves to 7.5.21, which satisfies e2b's ^7.5.19 without
# an exception. They age out on 2026-07-30 and 2026-08-03 — drop both entries then.
minimumReleaseAgeExcludes = [
"@typescript/native-preview",
"@earendil-works/pi-agent-core",
"@earendil-works/pi-ai",
"@earendil-works/pi-coding-agent",
"@earendil-works/pi-tui",
"next",
"@next/env",
"@next/swc-darwin-arm64",
"@next/swc-darwin-x64",
"@next/swc-linux-arm64-gnu",
"@next/swc-linux-x64-gnu",
"@anthropic-ai/sdk",
"@e2b/code-interpreter",
"e2b",
]
# mermaid 11.16.1 (published 2026-08-04) clears five open Dependabot advisories that
# 11.15.0 carries: architecture-diagram and config-API prototype pollution, radar and
# XY-chart DoS, and CSS injection into siblings of the diagram. It is inside the 7-day
# window and cannot be installed without an exception; it ages out on 2026-08-11 — drop
# the entry then, and re-date this note on any further bump rather than deleting the entry
# early, because removing it while the pinned version is still inside the window blocks the
# bump outright. js-yaml 4.3.1 (published 2026-07-31) carries the CVE-2026-59870 !!omap
# quadratic-CPU fix, which was never backported to the 4.3.0 line; it ages out on 2026-08-07,
# so that entry can go on the next touch of this file.
minimumReleaseAgeExcludes = ["@typescript/native-preview", "mermaid", "js-yaml"]

[run]
env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
"drizzle-orm": "^0.45.2",
"postgres": "^3.4.5",
"minimatch": "^10.2.5",
"mermaid": "11.15.0",
"mermaid": "11.16.1",
"zod": "4.3.6",
"e2b": "^2.36.1"
},
Expand Down
Loading