Repository navigation
chore(deps): bump defu from 6.1.4 to 6.1.6 in /autobot-frontend in the npm_and_yarn group across 1 directory - #3624
Merged
mrveiss merged 1 commit intoApr 7, 2026
Conversation
Bumps the npm_and_yarn group with 1 update in the /autobot-frontend directory: [defu](https://github.com/unjs/defu). Updates `defu` from 6.1.4 to 6.1.6 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.6) --- updated-dependencies: - dependency-name: defu dependency-version: 6.1.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
mrveiss
deleted the
dependabot/npm_and_yarn/autobot-frontend/npm_and_yarn-47ab31ee9e
branch
April 7, 2026 07:31
Contributor
✅ SSOT Configuration Compliance: Passing🎉 No hardcoded values detected that have SSOT config equivalents! |
Contributor
AutoBot Phase Validation ResultsSystem Maturity: 0.0% Phase Status:Recommendations: |
mrveiss
added a commit
that referenced
this pull request
Apr 8, 2026
…updates (#3949) * fix(workflow): prevent checkpoint expiry for paused workflows (#3231) (#3448) * fix(security): add auth to /events/sync endpoint (#3452) (#3459) Apply get_current_user dependency at APIRouter level so every route under /events requires a valid bearer token. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): add auth to browser MCP endpoints (#3451) (#3460) /browser/mcp/status requires get_current_user. /browser/mcp/navigate and /browser/mcp/screenshot require require_admin as they can trigger arbitrary page loads and screenshot capture. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): revert get_current_user on /events/sync — agents have no bearer token (#3452) The router-level get_current_user dependency breaks all node agent event syncs: agents post to /api/events/sync with no Authorization header and are identified by node_id validated against the Node table. The endpoint is intentionally exempt from bearer-token auth per security_headers.py (#3193). Add explanatory comment documenting the intended security model. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): harden ALLOWED_EXECUTABLES — dpkg/git-stash/find guards (#3450) * fix(slm): remove write-capable executables from ALLOWED_EXECUTABLES (#3450) - Remove apt, yum, dnf, rpm (package install/remove) from allowlist entirely - Remove wget, curl (arbitrary file write/exfiltration), nmap (network scanner with --script exploit support) from allowlist entirely - Add _GIT_ALLOWED_SUBCOMMANDS frozenset; _validate_command now rejects any git subcommand not in the read-only set (status, log, diff, show, branch, tag, remote, describe, shortlog, rev-parse, ls-files, ls-remote, stash) - find: _validate_command rejects any command containing -exec or -execdir tokens - Fix the inaccurate inline comment that claimed callers enforce git read-only; enforcement is now in _validate_command itself - Add tests for all new guards (write-capable rejection, git subcommand guard, find -exec guard) Closes #3450 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(security): add dpkg and git-stash argument guards (#3450) Address review findings on PR #3457: - dpkg: restrict to read-only query flags (-l/-s/-L/-S/--list etc); -i/--install/--purge/--unpack and all write flags now return HTTP 400 - git stash: tokens[2] is now validated; only stash list/show pass; stash pop/drop/clear/push/apply return HTTP 400 - Add tests for both guards in nodes_execution_test.py Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(deps): bump defu (#3624) Bumps the npm_and_yarn group with 1 update in the /autobot-frontend directory: [defu](https://github.com/unjs/defu). Updates `defu` from 6.1.4 to 6.1.6 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.6) --- updated-dependencies: - dependency-name: defu dependency-version: 6.1.6 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates (#3623) Bumps the npm_and_yarn group with 2 updates in the /autobot-frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [defu](https://github.com/unjs/defu). Bumps the npm_and_yarn group with 1 update in the /autobot-slm-frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 8.0.3 to 8.0.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite) Updates `defu` from 6.1.4 to 6.1.6 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.6) Updates `vite` from 7.3.1 to 7.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.2 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the npm_and_yarn group across 4 directories with 2 updates Bumps the npm_and_yarn group with 2 updates in the /.mcp directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-autobot-tracker directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-structured-thinking directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 2 updates in the /autobot-infrastructure/shared/mcp/tools/mcp-task-manager-server directory: [@hono/node-server](https://github.com/honojs/node-server) and [hono](https://github.com/honojs/hono). Updates `@hono/node-server` from 1.19.11 to 1.19.13 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.11...v1.19.13) Updates `hono` from 4.12.7 to 4.12.12 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.12) Updates `@hono/node-server` from 1.19.11 to 1.19.13 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.11...v1.19.13) Updates `hono` from 4.12.7 to 4.12.12 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.12) Updates `@hono/node-server` from 1.19.11 to 1.19.13 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.11...v1.19.13) Updates `hono` from 4.12.7 to 4.12.12 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.12) Updates `@hono/node-server` from 1.19.11 to 1.19.13 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.11...v1.19.13) Updates `hono` from 4.12.7 to 4.12.12 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.12) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 1.19.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.12 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Martins Veiss <martins.veiss@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /autobot-frontend directory: defu.
Updates
defufrom 6.1.4 to 6.1.6Release notes
Sourced from defu's releases.
Changelog
Sourced from defu's changelog.
Commits
001c290chore(release): v6.1.6407b516build: fix mixed types23e59e6chore(release): v6.1.511ba022fix: ignore inherited enumerable properties3942bfbfix: prevent prototype pollution via__proto__in defaults (#156)d3ef16dchore(deps): update actions/checkout action to v6 (#151)869a053chore(deps): update actions/setup-node action to v6 (#149)a97310cchore(deps): update codecov/codecov-action action to v6 (#154)89df6bbchore: fix typecheck9237d9cci: bump nodeDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.