Repository navigation
Fix web Dependabot alerts and require patched certifi in watcher - #342
Merged
Merged
Conversation
Bump fast-uri to 3.1.9 in web/ and override the zod copy that @vercel/cli-config pins at 4.1.11, so every zod in web/ is 4.6.7. Require certifi>=2026.10.19 in the watcher. `uv tool install` ignores uv.lock, so lab PCs installed before October 19 can still have a certifi bundle that trusts the compromised eMudhra/emSign certificates. Bump the watcher to 1.2.3 so the floor reaches them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependabot (web/): closes all five open alerts.
^3.0.1, so only the lockfile changes.@vercel/cli-configpins an exact4.1.11, and its latest release still does. A"zod": "$zod"override makes every copy follow our direct dependency, now^4.6.7.Watcher: eMudhra/emSign certificate compromise
certifi>=2026.10.19to the watcher's dependencies. The watcher talks to Data Hub and S3 through requests, which trusts certifi's bundle.uv tool installignoresuv.lock, so lab PCs installed before October 19 can still have a certifi that trusts the compromised certificates.No changelog entry, because these are dependency updates and a watcher-only release.
After merge
Tag
watcher-v1.2.3onproductionand advertise it in Settings → Watchers so lab PCs upgrade.Testing
make checkmake fe-test-unit(799 passed) andmake py-test-unit(1093 passed)npm ls zod fast-uriinweb/shows a single zod@4.6.7 and fast-uri@3.1.9Requires-Dist: certifi>=2026.10.19🤖 Generated with Claude Code