fix(deps): patch ws (HIGH) and python aiohttp/idna advisories - #161
Merged
Conversation
- ws via pnpm-workspace.yaml overrides: >=7.0.0<7.5.11 -> 7.5.11, >=8.0.0<8.21.0 -> 8.21.0 (CVE-2026-48779 HIGH; also clears CVE-2026-45736 ws<8.20.1) - python aiohttp>=3.14.1, idna>=3.15 via [tool.uv] override - uuid 11.1.0->11.1.1 already pinned (unchanged) js-yaml 3.15.0 (CVE-2026-53550, MEDIUM) deferred: blocked by repo minimumReleaseAge (10d) until ~2026-07-07.
There was a problem hiding this comment.
Pull request overview
Updates dependency resolution to remediate Dependabot security advisories across the JavaScript (pnpm) and Python (uv) dependency trees.
Changes:
- Pin
wsto non-vulnerable patch versions across both major lines via pnpm overrides and lockfile updates. - Bump Python packages in the uv lock to patched versions (
aiohttpandidna) and record corresponding overrides inpyproject.toml. - Regenerate lockfiles (
pnpm-lock.yaml,uv.lock) to reflect the updated resolutions.
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
uv.lock |
Updates resolved Python dependency versions (notably aiohttp and idna) and refreshes uv’s lock metadata. |
pyproject.toml |
Adds/updates tool.uv override constraints for aiohttp and idna to enforce patched versions. |
pnpm-workspace.yaml |
Adds pnpm overrides to force patched ws versions for both v7 and v8 vulnerable ranges. |
pnpm-lock.yaml |
Reflects updated override resolutions to ws@7.5.11 and ws@8.21.0 in the generated lockfile. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ari-ethena
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Patch the
wsHIGH advisory (npm) andaiohttp/idnaadvisories (python) inethena_sats_adapters.Why
Open Dependabot alerts:
wsCVE-2026-48779 (HIGH) — vulnerable>=7.0.0,<7.5.11and>=8.0.0,<8.21.0; also clears CVE-2026-45736 (<8.20.1, medium)aiohttpCVE-2026-34993 / 47265 / 54273 / 54274 / 54276 / 54277 / 54278 (medium, python)idnaCVE-2026-45409 (medium, python)Test plan
pnpm install --lockfile-onlyregenerated;pnpm-lock.yamlnow resolveswsto 7.5.11 and 8.21.0 only — no vulnerablewsremains.uv lockregenerated; aiohttp 3.14.1, idna 3.18.wspinned viapnpm-workspace.yamloverrides (pnpm v11 no longer readspackage.json#pnpm), mirroring the existing two-majorbrace-expansionoverride style.uuid(CVE-2026-41907) is already pinned11.1.0 -> 11.1.1in that file.Security & Data Impact
Security impact: Removes a HIGH
wsadvisory (WebSocket lib) from the tree via package-manager override; no application code changed.Data classification affected: None
Audit log updated: n/a
Deferred
js-yamlCVE-2026-53550 (MEDIUM) — the only fixed version, 3.15.0, was published ~13 h inside the repo'sminimumReleaseAge: 14400(10-day) supply-chain policy, sopnpmrefuses to resolve it yet. It becomes installable ~2026-07-07; re-runpnpm installthen (or let Dependabot open its own PR once mature).uuid@8.3.2remains in the tree via legacy build tooling (npmlog/gauge) — a different, API-incompatible major; not force-bumped.Rollback
No state migration — revert commit is sufficient.