Repository navigation
Fix the red main build, patch media-discovery's critical next CVEs, mark vendored packages private - #31
Merged
Conversation
…indings - next ^15.0.3 (locked 15.5.7) -> ^15.5.29, the latest 15.x backport. Fixes the Server Actions source exposure (GHSA-w37m-7fhw-fmv9) and the critical Image Optimization / Windows RCEs (GHSA-2464-fhr4-w9xw, GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36). eslint-config-next follows. - vitest ^2.1 -> ^5.1 (critical tinypool / vitest UI findings), with vite ^7.3.7 and @vitejs/plugin-react ^4.7 to satisfy its peers. The app has no tests. - override next's pinned postcss 8.4.31 to ^8.5.32 (high sourceMappingURL / stringify findings). - npm audit fix for the remaining transitive highs. - drop 9 version-less placeholder entries from package-lock.json (unpublished @ruvector platform binaries) that made `npm ci` fail with "Invalid Version". next build and tsc --noEmit pass. Co-Authored-By: claude-flow <ruv@ruv.net>
…h audit findings
- zod ^3.23 -> ^4.6.7 (GHSA: unbounded memory on oversized collections; all
3.x affected). ZodError.errors -> .issues in the three API routes.
- ai ^4 -> ^5.0.285 and @ai-sdk/openai ^1 -> ^2.0.140 (ai 4 pulls the
vulnerable jsondiffpatch; ai 5 accepts zod 4). generateObject/generateText
call sites are unchanged.
- remove @ai-sdk/google: it was imported but never called.
- override undici under @ai-sdk/provider-utils to ^6.29.1; provider-utils
3.0.44 still asks for undici ^5.29, which carries the TLS-validation-bypass
and smuggling highs. Its Agent({connect:{lookup}}) + fetch usage is the same
in undici 6.
npm audit: 0 critical, 0 high (6 moderate in eslint tooling). npm ci,
tsc --noEmit and next build pass; /api/search returns zod 4 issues for a bad
body.
Co-Authored-By: claude-flow <ruv@ruv.net>
apps/agentic-synth declares @ruvector/agentic-synth and apps/agentic-flow declares agentic-flow; both names are published from their own repos (ruvnet/ruvector, ruvnet/agentic-flow). "private": true makes npm refuse to publish these vendored copies over them. No workflow publishes them (the only npm publish step is packages/cli/npm in cli-release.yml), so no workflow change. Co-Authored-By: claude-flow <ruv@ruv.net>
…r/router
src/backends/detector.ts, factory.ts and RuVectorBackend.ts lazily
import('@ruvector/core') and fall back when it is missing, so it belongs in
optionalDependencies; ^0.1.35 is the current release. @ruvector/router is
not imported anywhere in apps/agentdb.
Co-Authored-By: claude-flow <ruv@ruv.net>
Every nested line in update-docs.yml was one level short (`push:` sat beside `on:`, `update-docs:` beside `jobs:`), so GitHub rejected the file and reported a failed run on every push to main and every fork PR. Re-indent it. The only behavioural change: when MINTLIFY_PROJECT_ID / MINTLIFY_API_KEY are not configured, the step now warns and skips instead of failing, so an unconfigured docs integration does not turn main red. Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four maintenance fixes, one commit each (the media-discovery fix is split across two).
main CI is red (update-docs.yml)
Every nested line in
.github/workflows/update-docs.ymlwas one indent level short, so GitHub rejected the file. That failure showed up on every push to main and on every fork PR. The file is re-indented. One behaviour change: when the Mintlify secrets are not configured, the step now logs a warning and skips. Before, it failed the run.media-discovery security
nextgoes from ^15.0.3 (locked at 15.5.7) to ^15.5.29, the latest 15.x backport. This fixes the Server Actions source-code exposure and the critical Image Optimizer and Windows RCEs.vitestgoes from ^2 to ^5, which clears the critical tinypool and vitest-UI findings.vite^7 and@vitejs/plugin-react^4.7 are bumped to satisfy its peer ranges. The app has no tests.zodgoes from ^3 to ^4,aifrom ^4 to ^5 and@ai-sdk/openaifrom ^1 to ^2. In the code,ZodError.errorsbecomes.issues.@ai-sdk/googlewas imported but never called, so it is removed.postcss^8.5.32 undernext(next pins 8.4.31) andundici^6.29.1 under@ai-sdk/provider-utils.@ruvectorplatform binaries), which madenpm cifail with "Invalid Version". The Dockerfile runsnpm ci. Those entries are removed.npm auditbefore: 3 critical and 20 high. After: 0 critical, 0 high, and 6 moderate in eslint tooling.npm ci,tsc --noEmitandnext buildpass.Name collisions
apps/agentic-synth(@ruvector/agentic-synth) andapps/agentic-flow(agentic-flow) are vendored copies of packages that other repos publish. Both are now"private": true. No workflow publishes them; the onlynpm publishispackages/cli/npm.agentdb dependencies
@ruvector/coreis imported lazily, with a fallback when it is missing. It is now declared underoptionalDependenciesat ^0.1.35.@ruvector/routerwas declared but never imported, so it is removed.🤖 Generated with claude-flow