Repository navigation
fix(deps): patch indexer and claim-relayer high advisories - #237
Merged
Merged
Conversation
Indexer: vite 6.4.3 -> 6.4.4 (patch, not the 8.x major in #234), source-map-js 1.2.2, body-parser 1.20.9, @vitest/mocker 4.1.12 via vitest ^4.1.12. Claim relayer: body-parser 1.20.9. Both lockfiles are regenerated, so overrides already declared (ws 8.21.0, qs 6.16.0, express 4.22.1, send, serve-static, cookie, esbuild) now resolve too.
tangletools
previously approved these changes
Oct 25, 2026
tangletools
left a comment
tangletools
left a comment
Contributor
There was a problem hiding this comment.
✅ Auto-approved PR — ec175fdc
Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.
tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-25T01:09:01Z
Envio v3 emits no generated/ package (MIGRATION_REPORT.md), nothing imports it, and pnpm leaves the missing file: dependency out of the lock, so every frozen install of the indexer failed with ERR_PNPM_OUTDATED_LOCKFILE.
tangletools
approved these changes
Oct 25, 2026
tangletools
left a comment
tangletools
left a comment
Contributor
There was a problem hiding this comment.
✅ Auto-approved PR — bf8ba412
Blanket team auto-approval is intentional. This is not a code review.
No automated review runs on this PR. This approval rests on the rule above alone.
tangletools · auto-approval · reason: blanket_auto_approve · 2026-10-25T01:28:02Z
This was referenced Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Patches the open high advisories in
indexer/andapps/claim-relayer/with patch releases, not majors.Change
indexer: vite 6.4.3 → 6.4.4 (alert 138), source-map-js 1.2.1 → 1.2.2 (134), body-parser → 1.20.9 (7), @vitest/mocker 4.1.12 via vitest ^4.1.12 (142/143).apps/claim-relayer: body-parser 1.20.6 → 1.20.9 (146).Both lockfiles regenerated with pnpm 10.33.4. The old locks predated overrides already in
package.json, so ws 8.21.0 (104/102), qs 6.16.0, express 4.22.1, send 0.19.2, serve-static 1.16.3, cookie 0.7.2 and esbuild 0.28.1 now resolve as declared.indexer: drops thegenerated: file:generatedoptional dependency (bf8ba41). Envio v3 emits nogenerated/package (MIGRATION_REPORT.md:22) and nothing imports it. pnpm leaves the missing local package out of the lock, so on main everypnpm install --frozen-lockfileinindexerfailed withERR_PNPM_OUTDATED_LOCKFILE(first gate atec175fd, beelink2-11ebeb94).Supersedes #231 (source-map-js), #234 (vite 8.3.5 major; 6.4.4 is the fixed 6.x release) and #235 (body-parser).
Not covered:
packages/migration-claim/sp1p3-challenger (88) has no compatible fixed SP1 release.Proof
Beelink gate at this head: frozen install,
envio codegen, typecheck andvitest runinindexer; frozen install, typecheck and build inapps/claim-relayer. Receipt below.Run ID: run_c1de7057b1f62d4b3470c5ae140c6ba9