From ce10bdbcef6b607ab65f0d161ecda6db03900704 Mon Sep 17 00:00:00 2001 From: Wasim Amiri <7220175+wasimxyz@users.noreply.github.com> Date: Mon, 26 Oct 2026 23:53:56 -0700 Subject: [PATCH] Fix web Dependabot alerts and require patched certifi in watcher Bump fast-uri to 3.1.9 in web/ and override the zod copy that @vercel/cli-config pins at 4.1.11, so every zod in web/ is 4.6.7. Require certifi>=2026.10.19 in the watcher. `uv tool install` ignores uv.lock, so lab PCs installed before October 19 can still have a certifi bundle that trusts the compromised eMudhra/emSign certificates. Bump the watcher to 1.2.3 so the floor reaches them. Co-Authored-By: Claude Opus 5.5 --- docs/site/src/lib/cli-catalog.snapshot.json | 2 +- uv.lock | 4 +++- watcher/pyproject.toml | 5 ++++- web/lib/mcp/docs/docs-bundle.snapshot.json | 2 +- web/package-lock.json | 17 ++++------------- web/package.json | 5 +++-- 6 files changed, 16 insertions(+), 19 deletions(-) diff --git a/docs/site/src/lib/cli-catalog.snapshot.json b/docs/site/src/lib/cli-catalog.snapshot.json index 6809da2f..80b42d3b 100644 --- a/docs/site/src/lib/cli-catalog.snapshot.json +++ b/docs/site/src/lib/cli-catalog.snapshot.json @@ -450,5 +450,5 @@ ] }, "prog": "data-hub-watcher", - "version": "1.2.2" + "version": "1.2.3" } diff --git a/uv.lock b/uv.lock index c2dcc42a..d541e889 100644 --- a/uv.lock +++ b/uv.lock @@ -450,10 +450,11 @@ requires-dist = [ [[package]] name = "data-hub-watcher" -version = "1.2.2" +version = "1.2.3" source = { editable = "watcher" } dependencies = [ { name = "awscrt" }, + { name = "certifi" }, { name = "click" }, { name = "packaging" }, { name = "pydantic" }, @@ -476,6 +477,7 @@ test = [ [package.metadata] requires-dist = [ { name = "awscrt", specifier = ">=0.27.0" }, + { name = "certifi", specifier = ">=2026.10.19" }, { name = "click", specifier = ">=8.2.1" }, { name = "packaging", specifier = ">=24.0" }, { name = "pydantic", specifier = ">=2.11.9" }, diff --git a/watcher/pyproject.toml b/watcher/pyproject.toml index aa6c8075..5b53bd7c 100644 --- a/watcher/pyproject.toml +++ b/watcher/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "data-hub-watcher" -version = "1.2.2" +version = "1.2.3" description = "File-watcher agent for lab instrument PCs that ingests data into Data Hub." readme = "README.md" requires-python = ">=3.12" @@ -25,6 +25,9 @@ classifiers = [ ] dependencies = [ "awscrt>=0.27.0", + # Not imported directly. requests trusts certifi's CA bundle, and older + # bundles still trust the compromised eMudhra/emSign certificates. + "certifi>=2026.10.19", "click>=8.2.1", "packaging>=24.0", "pydantic>=2.11.9", diff --git a/web/lib/mcp/docs/docs-bundle.snapshot.json b/web/lib/mcp/docs/docs-bundle.snapshot.json index 95b74934..cc9d0c46 100644 --- a/web/lib/mcp/docs/docs-bundle.snapshot.json +++ b/web/lib/mcp/docs/docs-bundle.snapshot.json @@ -148,7 +148,7 @@ "page": "cli-reference", "title": "Watcher CLI", "description": "Every data-hub-watcher command, subcommand, and flag in one place: init, watch, upload, config, service, state, and self-update.", - "markdown": "# Watcher CLI (/docs/cli-reference)\n\n\n\n**For:** Lab operators\n\nFlags and subcommands for `data-hub-watcher`, generated from the Click CLI in the watcher package. For task walkthroughs see [Install and update the watcher](/docs/install-the-watcher), [Run as a Windows service](/docs/windows-service), and [Roll out watcher releases](/docs/watcher-releases).\n\n## Command reference [#command-reference]\n\nThe catalog below lists every command, argument, and option from the installed CLI help text.\n\n## Global flags\n\nThese options apply to every `data-hub-watcher` command (watcher 1.2.2).\n\n**Flags**\n\n- `--config PATH` `path` env: `DATA_HUB_CONFIG_PATH` — Override config file path.\n- `--verbose` `boolean` — Enable debug logging.\n- `--version` `boolean` — Show the version and exit.\n\n## `data-hub-watcher config`\n\nView and manage the watcher config file.\n\n### `data-hub-watcher config edit`\n\nRe-prompt each config field with current values as defaults.\n\n### `data-hub-watcher config open`\n\nOpen the config file in your editor, then re-validate.\n\n**Flags**\n\n- `--editor` `text` — Editor command (e.g. --editor code).\n\n### `data-hub-watcher config path`\n\nPrint the resolved config file path.\n\n### `data-hub-watcher config set-environment`\n\nSwitch the watcher to a different API environment.\n\n**Arguments**\n\n- `ENVIRONMENT` (required) `choice (staging | production | preview)`\n\n**Flags**\n\n- `--api-base-url` `text` — API base URL for the target environment. Required the first time you switch to an environment; reused from config on later switches.\n- `--api-key` `text` — API key for the target environment.\n- `--show-key` `boolean` — Echo the API key as typed (useful on Windows terminals).\n- `--no-register` `boolean` — Fail instead of registering a new watcher if none is stored for the target env.\n\n### `data-hub-watcher config show`\n\nPretty-print the current config.\n\n### `data-hub-watcher config validate`\n\nValidate the config file (offline, no network calls).\n\n## `data-hub-watcher init`\n\nInteractive setup wizard + API registration.\n\n**Flags**\n\n- `--show-key` `boolean` — Echo the API key as it is typed/pasted. Useful on Windows terminals where hidden input is unreliable for paste.\n\n## `data-hub-watcher self-update`\n\nCheck the server for a newer watcher release and upgrade in place. Designed for unattended use — schedule via Windows Task Scheduler (e.g. weekly) so lab PCs converge on the latest published version without operator intervention.\n\n**Flags**\n\n- `--check` `boolean` — Print the server-reported target version without performing the upgrade.\n- `--force` `boolean` — Run the upgrade subprocess even if the local version already matches the target.\n\n## `data-hub-watcher service`\n\nWindows service management.\n\n### `data-hub-watcher service install`\n\nInstall the watcher as a Windows service.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env..\n\n### `data-hub-watcher service reinstall`\n\nStop, uninstall, install, and start the watcher Windows service. Useful after upgrading the watcher wheel from an Administrator shell so the SCM picks up the new ``data_hub_watcher.service`` entrypoint without needing four separate ``service`` invocations.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env..\n\n### `data-hub-watcher service start`\n\nStart the watcher Windows service.\n\n### `data-hub-watcher service status`\n\nShow the watcher Windows service status.\n\n### `data-hub-watcher service stop`\n\nStop the watcher Windows service.\n\n### `data-hub-watcher service uninstall`\n\nUninstall the watcher Windows service.\n\n## `data-hub-watcher state`\n\nInspect or reset the local upload history.\n\n### `data-hub-watcher state forget`\n\nForget upload history under a folder so those files are reported again. Clears every state database a watcher on this PC can open: the one `watch` uses and the one the Windows service uses. Stop the watcher first. It only scans the disk when it starts, so a running watcher will not pick the forgotten files back up.\n\n**Flags**\n\n- `--prefix` (required) `text` — Folder under the watch directory to forget, e.g. alice/.\n- `--yes` `boolean` — Skip the confirmation prompt.\n\n## `data-hub-watcher upload`\n\nUpload files to Data Hub (manual trigger). One-shot mode: pass both --file and --run-id to upload a single file. Queue mode: omit both to process the server-side upload queue.\n\n**Flags**\n\n- `--file PATH` `path` — Specific file to upload.\n- `--run-id` `text` — Associate upload with a specific run.\n- `--dry-run` `boolean` — Log what would be uploaded without uploading.\n\n## `data-hub-watcher watch`\n\nStart watching for new files.\n\n**Flags**\n\n- `--dry-run` `boolean` — Validate and log but don't start monitoring.\n\n## Interactive setup notes [#interactive-setup-notes]\n\n`init` and `config edit` prompt for values in the terminal. Those prompts are not CLI flags, so they do not appear in the catalog.\n\nKeys must start with `dhub_`. The watcher strips zero-width and non-breaking-space characters that some Windows clipboards inject. See [Install and update the watcher → Configure](/docs/install-the-watcher#configure).\n\n## Upload examples [#upload-examples]\n\nOne-shot upload outside the watch loop:\n\n```sh\ndata-hub-watcher upload --file /path/to/file.csv --run-id RUN001\ndata-hub-watcher upload\ndata-hub-watcher upload --dry-run\n```\n\nPass both `--file` and `--run-id`, or omit both to process the server-side queue in manual mode.\n\n## Switching environments [#switching-environments]\n\n`config set-environment` (and `config edit` when the environment changes) can take `--api-base-url`, `--api-key`, `--show-key`, and `--no-register`. Preview switches require `--api-base-url` the first time. See [Watcher configuration → Switching environments](/docs/configuration-reference#switching-environments).\n\n## Windows service notes [#windows-service-notes]\n\n`service` commands require Windows and the `windows-service` install extra. Use `--env-path` on `service install` and `service reinstall` when the service should load a non-default `.env` file. Full details are in [Run as a Windows service](/docs/windows-service).\n\n## Self-update examples [#self-update-examples]\n\n```sh\ndata-hub-watcher self-update\ndata-hub-watcher self-update --check\ndata-hub-watcher self-update --force\n```\n\nUpgrade behavior depends on how you installed the watcher. See [Install and update the watcher → Manual update](/docs/install-the-watcher#manual-update-self-update).\n" + "markdown": "# Watcher CLI (/docs/cli-reference)\n\n\n\n**For:** Lab operators\n\nFlags and subcommands for `data-hub-watcher`, generated from the Click CLI in the watcher package. For task walkthroughs see [Install and update the watcher](/docs/install-the-watcher), [Run as a Windows service](/docs/windows-service), and [Roll out watcher releases](/docs/watcher-releases).\n\n## Command reference [#command-reference]\n\nThe catalog below lists every command, argument, and option from the installed CLI help text.\n\n## Global flags\n\nThese options apply to every `data-hub-watcher` command (watcher 1.2.3).\n\n**Flags**\n\n- `--config PATH` `path` env: `DATA_HUB_CONFIG_PATH` — Override config file path.\n- `--verbose` `boolean` — Enable debug logging.\n- `--version` `boolean` — Show the version and exit.\n\n## `data-hub-watcher config`\n\nView and manage the watcher config file.\n\n### `data-hub-watcher config edit`\n\nRe-prompt each config field with current values as defaults.\n\n### `data-hub-watcher config open`\n\nOpen the config file in your editor, then re-validate.\n\n**Flags**\n\n- `--editor` `text` — Editor command (e.g. --editor code).\n\n### `data-hub-watcher config path`\n\nPrint the resolved config file path.\n\n### `data-hub-watcher config set-environment`\n\nSwitch the watcher to a different API environment.\n\n**Arguments**\n\n- `ENVIRONMENT` (required) `choice (staging | production | preview)`\n\n**Flags**\n\n- `--api-base-url` `text` — API base URL for the target environment. Required the first time you switch to an environment; reused from config on later switches.\n- `--api-key` `text` — API key for the target environment.\n- `--show-key` `boolean` — Echo the API key as typed (useful on Windows terminals).\n- `--no-register` `boolean` — Fail instead of registering a new watcher if none is stored for the target env.\n\n### `data-hub-watcher config show`\n\nPretty-print the current config.\n\n### `data-hub-watcher config validate`\n\nValidate the config file (offline, no network calls).\n\n## `data-hub-watcher init`\n\nInteractive setup wizard + API registration.\n\n**Flags**\n\n- `--show-key` `boolean` — Echo the API key as it is typed/pasted. Useful on Windows terminals where hidden input is unreliable for paste.\n\n## `data-hub-watcher self-update`\n\nCheck the server for a newer watcher release and upgrade in place. Designed for unattended use — schedule via Windows Task Scheduler (e.g. weekly) so lab PCs converge on the latest published version without operator intervention.\n\n**Flags**\n\n- `--check` `boolean` — Print the server-reported target version without performing the upgrade.\n- `--force` `boolean` — Run the upgrade subprocess even if the local version already matches the target.\n\n## `data-hub-watcher service`\n\nWindows service management.\n\n### `data-hub-watcher service install`\n\nInstall the watcher as a Windows service.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env..\n\n### `data-hub-watcher service reinstall`\n\nStop, uninstall, install, and start the watcher Windows service. Useful after upgrading the watcher wheel from an Administrator shell so the SCM picks up the new ``data_hub_watcher.service`` entrypoint without needing four separate ``service`` invocations.\n\n**Flags**\n\n- `--env-path FILE` `file` — Path to the .env file. Defaults to ~/.data-hub/.env..\n\n### `data-hub-watcher service start`\n\nStart the watcher Windows service.\n\n### `data-hub-watcher service status`\n\nShow the watcher Windows service status.\n\n### `data-hub-watcher service stop`\n\nStop the watcher Windows service.\n\n### `data-hub-watcher service uninstall`\n\nUninstall the watcher Windows service.\n\n## `data-hub-watcher state`\n\nInspect or reset the local upload history.\n\n### `data-hub-watcher state forget`\n\nForget upload history under a folder so those files are reported again. Clears every state database a watcher on this PC can open: the one `watch` uses and the one the Windows service uses. Stop the watcher first. It only scans the disk when it starts, so a running watcher will not pick the forgotten files back up.\n\n**Flags**\n\n- `--prefix` (required) `text` — Folder under the watch directory to forget, e.g. alice/.\n- `--yes` `boolean` — Skip the confirmation prompt.\n\n## `data-hub-watcher upload`\n\nUpload files to Data Hub (manual trigger). One-shot mode: pass both --file and --run-id to upload a single file. Queue mode: omit both to process the server-side upload queue.\n\n**Flags**\n\n- `--file PATH` `path` — Specific file to upload.\n- `--run-id` `text` — Associate upload with a specific run.\n- `--dry-run` `boolean` — Log what would be uploaded without uploading.\n\n## `data-hub-watcher watch`\n\nStart watching for new files.\n\n**Flags**\n\n- `--dry-run` `boolean` — Validate and log but don't start monitoring.\n\n## Interactive setup notes [#interactive-setup-notes]\n\n`init` and `config edit` prompt for values in the terminal. Those prompts are not CLI flags, so they do not appear in the catalog.\n\nKeys must start with `dhub_`. The watcher strips zero-width and non-breaking-space characters that some Windows clipboards inject. See [Install and update the watcher → Configure](/docs/install-the-watcher#configure).\n\n## Upload examples [#upload-examples]\n\nOne-shot upload outside the watch loop:\n\n```sh\ndata-hub-watcher upload --file /path/to/file.csv --run-id RUN001\ndata-hub-watcher upload\ndata-hub-watcher upload --dry-run\n```\n\nPass both `--file` and `--run-id`, or omit both to process the server-side queue in manual mode.\n\n## Switching environments [#switching-environments]\n\n`config set-environment` (and `config edit` when the environment changes) can take `--api-base-url`, `--api-key`, `--show-key`, and `--no-register`. Preview switches require `--api-base-url` the first time. See [Watcher configuration → Switching environments](/docs/configuration-reference#switching-environments).\n\n## Windows service notes [#windows-service-notes]\n\n`service` commands require Windows and the `windows-service` install extra. Use `--env-path` on `service install` and `service reinstall` when the service should load a non-default `.env` file. Full details are in [Run as a Windows service](/docs/windows-service).\n\n## Self-update examples [#self-update-examples]\n\n```sh\ndata-hub-watcher self-update\ndata-hub-watcher self-update --check\ndata-hub-watcher self-update --force\n```\n\nUpgrade behavior depends on how you installed the watcher. See [Install and update the watcher → Manual update](/docs/install-the-watcher#manual-update-self-update).\n" }, { "page": "security", diff --git a/web/package-lock.json b/web/package-lock.json index f0d4059c..14576959 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -54,7 +54,7 @@ "tailwind-merge": "^3.5.0", "tw-animate-css": "^1.4.0", "yaml": "^2.8.3", - "zod": "^4.4.3" + "zod": "^4.6.7" }, "devDependencies": { "@biomejs/biome": "^2.4.16", @@ -7587,15 +7587,6 @@ "zod": "4.1.11" } }, - "node_modules/@vercel/cli-config/node_modules/zod": { - "version": "4.1.11", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.11.tgz", - "integrity": "sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg==", - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/colinhacks" - } - }, "node_modules/@vercel/cli-exec": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/@vercel/cli-exec/-/cli-exec-1.0.0.tgz", @@ -9812,9 +9803,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", - "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "funding": [ { "type": "github", diff --git a/web/package.json b/web/package.json index 3223056d..0c440999 100644 --- a/web/package.json +++ b/web/package.json @@ -79,7 +79,7 @@ "tailwind-merge": "^3.5.0", "tw-animate-css": "^1.4.0", "yaml": "^2.8.3", - "zod": "^4.4.3" + "zod": "^4.6.7" }, "devDependencies": { "@biomejs/biome": "^2.4.16", @@ -108,6 +108,7 @@ "body-parser": "^2.3.0", "brace-expansion": "^5.0.7", "esbuild": "^0.28.1", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.0", + "zod": "$zod" } }