Skip to content

fix(security): close open Dependabot vulnerability alerts - #830

Merged
santoshkumarradha merged 3 commits into
mainfrom
santosh/fix-dependabot-vulns-82b5
Jul 28, 2026
Merged

fix(security): close open Dependabot vulnerability alerts#830
santoshkumarradha merged 3 commits into
mainfrom
santosh/fix-dependabot-vulns-82b5

Conversation

@santoshkumarradha

@santoshkumarradha santoshkumarradha commented Jul 27, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Member

Summary

Single PR that upgrades all currently open Dependabot-alerted packages so the security alerts can auto-close once merged.

High

Alerts Package Fix
#319 google.golang.org/grpc (control-plane/go.mod) 1.80.0 → 1.82.1
#342–#347 react-router (web client locks) migrate react-router-dom → react-router@8.3.0 (React ≥19.2.7)
#306–#310 brace-expansion (web client locks) 1.1.16 / 2.1.2 via overrides
#308/#311/#312 js-yaml 4.3.0
#343/#346/#348/#350/#351 postcss ≥8.5.18
#320/#325/#326 fast-uri 3.1.4
#328/#331/#335 next (rag evaluation UI) 15.5.18 → 15.5.22
#327 sharp (via next) override 0.35.3

Moderate / Low

Alerts Package Fix
#336–#341 react-router (XSS / constructor injection / open redirect) covered by react-router@8.3.0
#329/#330/#332/#333/#334 next (cache confusion, Server Actions, image SVG DoS, endpoint disclosure) covered by next@15.5.22
#322/#323/#324 hono (header de-dupe, cx() XSS, JSX context isolation) override 4.12.32 in mastra-bench
#321 @hono/node-server (Windows %5C path traversal) override 2.0.12 in mastra-bench
#317/#318 body-parser 2.3.0 (mastra-bench) / 1.20.6 (sdk/typescript)

Also bumps control-plane / coverage / release Node for web builds to 22 because react-router@8 requires Node ≥22.22.

Supersedes Dependabot PRs #804 and #824.

Type of change

  • Bug fix
  • CI / tooling
  • Breaking change (web client import path: react-router-dom → react-router)

Test plan

  • cd control-plane && GOTOOLCHAIN=auto go build -o /tmp/af-test ./cmd/af
  • cd control-plane/web/client && npm run build
  • cd control-plane/web/client && npm test (683 passed)
  • cd sdk/typescript && npm test (807 passed)
  • cd desktop && npm run typecheck
  • cd examples/benchmarks/100k-scale/mastra-bench && npm audit → 0 vulnerabilities
  • Confirmed patched versions present in all affected lockfiles

Test coverage

  • I ran tests for the surface(s) I changed locally.
  • No new uncovered production logic; dependency/import migration only plus a type cast in ExecutionForm.tsx.
  • Coverage gate check green in CI (pending).

Related issues / PRs

Open in Web Open in Cursor 

cursoragent and others added 2 commits July 27, 2026 15:04
@cursoragent @santoshkumarradha
fix(security): resolve open Dependabot vulnerability alerts
b65ea0c 
Bump vulnerable direct and transitive dependencies across Go and npm
lockfiles, and migrate the web client from react-router-dom v7 to
react-router v8 (required for the RSC CSRF advisory patch).

- google.golang.org/grpc 1.80.0 -> 1.82.1 (control-plane)
- react-router 8.3.0 (replaces react-router-dom; React >=19.2.7)
- next 15.5.18 -> 15.5.22, sharp -> 0.35.3 (rag_evaluation UI)
- js-yaml -> 4.3.0, brace-expansion -> 1.1.16/2.1.2, postcss -> >=8.5.18
- fast-uri -> 3.1.4 (desktop, mastra-bench)
- CI Node for control-plane/web builds: 20 -> 22

Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
@cursoragent @santoshkumarradha
fix(security): bump hono and @hono/node-server in mastra-bench
9f94ecd 
Override transitive hono to 4.12.32 and @hono/node-server to 2.0.12
to clear remaining moderate Dependabot alerts (JSX context isolation,
cx() XSS, API Gateway header de-dupe, Windows serve-static path traversal).

Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
@github-actions

github-actions Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Performance

SDK Memory Δ Latency Δ Tests Status
TS 488 B +39% 1.46 µs -27% ✓ ✗

⚠ Regression detected:

  • TypeScript memory: 350 B → 488 B (+39%)

@CLAassistant

CLAassistant commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface Current Baseline Δ
control-plane 86.80% 87.40% ↓ -0.60 pp 🟡
sdk-go 92.50% 92.00% ↑ +0.50 pp 🟢
sdk-python 93.82% 93.73% ↑ +0.09 pp 🟢
sdk-typescript 91.05% 90.42% ↑ +0.63 pp 🟢
web-ui 84.75% 84.79% ↓ -0.04 pp 🟡
aggregate 85.51% 85.75% ↓ -0.24 pp 🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

@github-actions

github-actions Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface Touched lines Patch coverage Status
control-plane 0 — ➖ no changes
sdk-go 0 — ➖ no changes
sdk-python 0 — ➖ no changes
sdk-typescript 0 — ➖ no changes
web-ui 0 — ➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.

@santoshkumarradha
santoshkumarradha marked this pull request as ready for review July 27, 2026 16:17
@santoshkumarradha
santoshkumarradha requested review from a team and AbirAbbas as code owners July 27, 2026 16:17
@Agent-Field Agent-Field deleted a comment from cursor Bot Jul 27, 2026
@AbirAbbas

AbirAbbas commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

@santoshkumarradha everything's green here except the license/cla check — needs your signature at https://cla-assistant.io/Agent-Field/agentfield?pullRequest=830 and then this can merge. It also supersedes dependabot's #824 (same grpc bump) and unblocks closing the broken #804.

@cursor

cursor Bot commented Jul 28, 2026

Copy link
Copy Markdown

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

@santoshkumarradha

santoshkumarradha commented Jul 28, 2026

Copy link
Copy Markdown
Member Author

@santoshkumarradha everything's green here except the license/cla check — needs your signature at https://cla-assistant.io/Agent-Field/agentfield?pullRequest=830 and then this can merge. It also supersedes dependabot's #824 (same grpc bump) and unblocks closing the broken #804.

Done sir

@santoshkumarradha
santoshkumarradha added this pull request to the merge queue Jul 28, 2026
Merged via the queue into main with commit fc4bdde Jul 28, 2026
34 checks passed
@santoshkumarradha
santoshkumarradha deleted the santosh/fix-dependabot-vulns-82b5 branch July 28, 2026 23:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AbirAbbas AbirAbbas AbirAbbas approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@santoshkumarradha @CLAassistant @AbirAbbas @cursoragent