Repository navigation
Bump the security group across 1 directory with 2 updates - #8133
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the security group with 2 updates in the / directory: [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) and [sprintf-js](https://github.com/alexei/sprintf.js). Updates `decode-uri-component` from 0.2.2 to 0.5.0 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.2...v0.5.0) Updates `sprintf-js` from 1.0.3 to 1.1.3 - [Changelog](https://github.com/alexei/sprintf.js/blob/master/CHANGELOG.md) - [Commits](alexei/sprintf.js@1.0.3...1.1.3) --- updated-dependencies: - dependency-name: decode-uri-component dependency-version: 0.5.0 dependency-type: direct:development dependency-group: security - dependency-name: sprintf-js dependency-version: 1.1.3 dependency-type: direct:development dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Devin Review found 5 potential issues.
1 security issue not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)
There was a problem hiding this comment.
🔍 Lockfile refresh broadens the upgrade
The lockfile also updates Immer, Sentry, Radix UI, and other desktop and web dependencies. These unrelated resolutions warrant validation beyond the two advertised packages.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
🔍 OpenTelemetry peers exclude resolved API
Several OpenTelemetry packages declare an API peer range below 1.10.0, but resolve API 1.10.0. Check compatibility before accepting the telemetry refresh.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "@tanstack/eslint-plugin-query": "^5.99.0", | ||
| "braces": "3.0.3", | ||
| "decode-uri-component": "0.2.2", | ||
| "decode-uri-component": "0.5.0", |
There was a problem hiding this comment.
🟡 CommonJS decoder call fails in CI
With decode-uri-component at 0.5.0, the regression check calls its require() result as a function. The ESM package returns a module namespace instead, so that test fails.
Learn more
The repository's security dependency regression test runs a separate Node process that loads the URI decoder with require() and calls the result directly. Version 0.5.0 is ESM, so Node's CommonJS interoperability produces a namespace rather than the callable default export. The test process exits unsuccessfully, making the required CI test command fail. See the regression check.
Example: With Node 22 supporting require(esm), const d = require('decode-uri-component'); d('%FF') invokes a namespace object and throws instead of returning %FF.
Recommended fix: Update the regression check to use the package's default export through import() in the spawned process; keep checking the malformed-input behavior. If CommonJS compatibility is required elsewhere, retain a compatible version or supply a CommonJS adapter.
Was this helpful? React with 👍 or 👎 to provide feedback.
| "@tanstack/eslint-plugin-query": "^5.99.0", | ||
| "braces": "3.0.3", | ||
| "decode-uri-component": "0.2.2", | ||
| "decode-uri-component": "0.5.0", |
There was a problem hiding this comment.
🟡 Plus-sign decoding breaks regression check
For decode('a+b'), version 0.5.0 returns a+b instead of the expected a b. The required dependency test fails.
Learn more
The regression check asserts that plus signs decode like spaces. Version 0.5.0 preserves plus signs, a change introduced in version 0.3.0. The test therefore fails even when imported successfully. The expectation appears at the decoder regression check.
Example: decode('a+b') now yields a+b, while the checked contract expects a b.
Recommended fix: Decide whether the repository needs form-style decoding. If yes, explicitly normalize plus signs before calling this package and test the wrapper. If no, update the regression check to match the new contract and audit any dependent callers.
Was this helpful? React with 👍 or 👎 to provide feedback.
| specifier: 0.5.0 | ||
| version: 0.5.0 |
There was a problem hiding this comment.
🟡 Checked-in Flatpak cache lacks new packages
A direct Flatpak build cannot install the upgraded packages: the offline source list lacks their tarballs. The manifest runs pnpm install --offline --frozen-lockfile, which needs them.
Learn more
The desktop Flatpak includes a checked-in list of npm tarballs that Flatpak downloads before executing its offline build. The new dependency resolution requires decoder 0.5.0 and sprintf 1.1.3, but the source list still records decoder 0.2.2 and 0.4.1 and sprintf 1.0.3. The Flatpak build cannot fetch replacements because pnpm uses --offline. The dispatch-only submission workflow regenerates this list, so its builds avoid this particular failure; builds using the committed manifest directly do not.
Example: A developer starts flatpak-builder with the checked-in manifest and source list; its pnpm install asks for the new decoder archive, which is absent from the prefetched store.
Recommended fix: Regenerate and commit the offline pnpm source list with the lockfile, or ensure every Flatpak build regenerates it before running the manifest.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
Closing as superseded by the compatibility-preserving security patches already on main. pnpm-workspace.yaml applies patches/decode-uri-component@0.2.2.patch (bounded UTF-8 scanner while retaining CommonJS and plus-to-space behavior) and patches/sprintf-js@1.0.3.patch (bounded width/precision without mutating cached formats). All five scripts/security-dependencies.test.mjs tests pass on the patched dependencies. This upgrade bypasses those version-specific patches, reintroduces the sprintf precision failure, changes decoder behavior, and refreshes unrelated lockfile dependencies. Keeping the existing tested backports avoids those regressions; no changes from this PR are being merged. |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
Bumps the security group with 2 updates in the / directory: decode-uri-component and sprintf-js.
Updates
decode-uri-componentfrom 0.2.2 to 0.5.0Release notes
Sourced from decode-uri-component's releases.
Commits
a12faba0.5.0fa479daRewrite decoder as single-pass UTF-8 scanner and expand tests38bdbecFix ci and tests89446f9AddsideEffects: falsetopackage.json(#23)00662930.4.1c345b4cAdd TypeScript type definitionsb3710c40.4.0b09e39dRequire Node.js 14 and move to ESM (#11)7268ef60.3.03bbc879Do not decode + to a space - fixes #3Updates
sprintf-jsfrom 1.0.3 to 1.1.3Changelog
Sourced from sprintf-js's changelog.
Commits
3a0d8c2Merge pull request #227 from alexei/feat-new_release1201d9efix: update deps, bump version for a new release0e0d875Merge pull request #226 from alexei/fix-licensinga5a7a0efix(license): update license name in README8a3a4bbMerge pull request #212 from BigBlueHat/patch-18bf82b5Make bower.json declaration match LICENSE00af1e6Merge pull request #197 from alexei/fix-typo92d5f7efix: typoe2b89caMerge pull request #195 from timgates42/bugfix_typo_precedea25d860Update CONTRIBUTORS.mdDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Bumps
decode-uri-component(0.2.2 → 0.5.0) andsprintf-js(1.0.3 → 1.1.3) as part of the security dependency group, updatingpnpm-lock.yamlaccordingly.Dependencies
decode-uri-component0.5.0 requires Node.js 14, ships as ESM, and no longer decodes+to a space.sprintf-js1.1.3 fixes%g,%o,%x, and%Xspecifier handling.Written for commit fa4b490. Summary will update on new commits.