Repository navigation
chore(deps): fix reachable/hygiene Dependabot alerts across Go and npm - #6405
Merged
Merged
Conversation
Bumps google.golang.org/grpc (v1.82.1 -> v1.84.0, fixing a reachable HTTP/2 DATA-frame-fragmentation OOM in parca's gRPC server), plus golang.org/x/crypto, github.com/apache/thrift, github.com/gorilla/websocket, go.opentelemetry.io/otel and its exporter modules, and github.com/prometheus/prometheus to their latest patched releases. The rest were assessed not-reachable or contained (no xDS/SSH/docker-daemon/ Prometheus-web-UI code paths in this codebase) but are bumped anyway for hygiene. The prometheus/prometheus bump renamed promql/parser's package-level ParseMetricSelector to a method on a parser instance; both call sites are updated accordingly. Also fixes a pre-existing bug in pkg/demangle surfaced by a stricter go vet printf check that activates once go.mod's language version reaches go1.26 (a side effect of the dependency bumps): the error message formatted the zero-value Option instead of the offending option string. github.com/docker/docker stays pinned; no version fixing its remaining advisories has been published yet, and it's used here only as a Prometheus service-discovery client, never running the vulnerable daemon-side code.
…security] Adds pnpm.overrides (kept in sync between ui/package.json and ui/pnpm-workspace.yaml, per this repo's existing convention) forcing ~70 transitive packages to their patched versions: axios, browserslist, svgo, ws, undici, js-yaml, form-data, follow-redirects, fast-uri, ip-address, qs, tar, tmp, uuid, sigstore/@sigstore/*, and others. Also bumps the direct dependencies vite (5.4.21 -> 6.4.3), vitest (1.6.1 -> 3.2.6), and react-router-dom (6.30.3 -> 6.30.6, which brings react-router and @remix-run/router along with it). Most of these packages were assessed not-reachable in production (dead webpack-dev-server subtree, build/CI-only tooling never bundled into the shipped SPA) but are bumped anyway for hygiene, verified via full build + type-check + lint + test + Storybook build. A postcss-selector-parser bump to 6.1.3 was reverted to 6.1.2: the two open advisories there require an untrusted AST input this build never produces (it only parses this repo's own CSS at build time), and 6.1.3 breaks tailwindcss@3.2.4's internal use of an undocumented private method. react-router's two remaining advisories (SSR deserializeErrors, and a backslash-redirect bypass) only ship a fix in the v7 line; this repo has no SSR and every Link/navigate call site uses hardcoded internal routes, so a major-version migration wasn't pursued for reachability this low. extract-zip has no patched version published yet upstream.
|
✅ Meticulous spotted 0 visual differences across 282 screens tested: view results. Meticulous evaluated ~4 hours of user flows against your PR. Expected differences? Click here. Last updated for commit |
…ricName The prometheus/prometheus bump surfaced a staticcheck SA1019 failure: labels.MetricName was deprecated in favor of prometheus/common/model's equivalent constant in the version this PR bumps to.
The prometheus bump pulled in a much larger transitive dependency graph (cloud service-discovery clients), pushing per-target build/link memory well above 2.5GB. Building all 6 GOOS/GOARCH targets at the default parallelism (== NumCPU, 4 on ubuntu-latest) exceeded the 16GB runner memory and silently OOM-killed the job with no error output. Limiting to 2 concurrent builds keeps peak memory in bounds.
Reconciles the v0.28.0 container-image vulnerability scan against the in-flight dependency bumps, covering categories the Dependabot alerts didn't surface: - Bump base image from alpine:3.23.3 to alpine:3.24.2, which carries OpenSSL 3.5.8, musl 1.2.6-r2, and zlib 1.3.2-r0 — resolving all 36 OS-layer CVEs (OpenSSL, musl qsort/iconv, zlib untgz/CRC32). - Bump .go-version from 1.26.1 to 1.26.8, the latest Go patch release, covering ~20 stdlib CVEs (crypto/x509, crypto/tls, net, net/http, html/template, encoding/asn1, net/mail, mime, os, archive/tar, etc.) fixed across the 1.26.2-1.26.6 patch releases. - Bump github.com/go-chi/chi/v5 to v5.3.0 and github.com/klauspost/compress to v1.18.7, both newly flagged by govulncheck as transitive deps pulled in by the earlier grpc/prometheus bumps. github.com/docker/docker, github.com/hamba/avro/v2, and the golang.org/x/crypto/openpgp package remain unaddressed: no patched upstream release exists for any of their flagged advisories as of this commit (confirmed via govulncheck and the module proxy version list). All are unreachable transitive-only code paths.
hadolint's :latest image started enforcing SC2006 (legacy backticks) and DL3066 (non-numeric USER) since the last green pre-commit run on main, independent of the security bumps in this branch.
Every other step in this job checks should_skip except this one, so a correctly-skipped run (e.g. a push that only touches files outside the job's watched paths) still executes pnpm/action-setup against a workspace with no checkout, and it fails outright instead of no-op'ing like its neighbors.
brancz
approved these changes
Sep 23, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Triaged all 124 open Dependabot advisories on this repo (Go + npm) and fixed the ones worth fixing:
google.golang.org/grpc(v1.82.1 → v1.84.0), fixing a genuinely reachable HTTP/2 DATA-frame-fragmentation OOM in parca's gRPC server (bound on:7070, all interfaces). Also bumpsgolang.org/x/crypto,github.com/apache/thrift,github.com/gorilla/websocket, thego.opentelemetry.io/otel*modules, andgithub.com/prometheus/prometheus— all assessed not-reachable or contained in this codebase (no xDS, no SSH usage, no Docker-daemon code, no Prometheus web UI mounted), bumped for hygiene. Includes two mechanical follow-ups:promql/parser.ParseMetricSelectorbecame an instance method in the new prometheus version (two call sites updated), and a pre-existingpkg/demanglebug that a strictergo vetprintf check now catches (go.mod's language version moved to go1.26 as a side effect of the bumps).pnpm.overrides(kept in sync betweenui/package.jsonandui/pnpm-workspace.yaml, matching this repo's existing pattern) forcing ~70 transitive packages to patched versions, plus direct bumps tovite(5.4.21 → 6.4.3),vitest(1.6.1 → 3.2.6), andreact-router-dom(6.30.3 → 6.30.6, bringingreact-router/@remix-run/routeralong). Most of these packages are dead code in this repo (an unused webpack-dev-server subtree, since this app builds with Vite; various build/CI-only tools) but are bumped anyway.Known gaps, left as-is:
github.com/docker/docker: no patched version has been published upstream yet for its remaining advisories; used here only as a Prometheus service-discovery client (never runs the vulnerable daemon-side code).extract-zip: no patched version published upstream.postcss-selector-parserstays pinned at 6.1.2: the 6.1.3 release breakstailwindcss@3.2.4's use of a private/undocumented method, and the two advisories there require untrusted AST input this build never produces (only parses this repo's own CSS at build time).react-router's two remaining advisories (SSRdeserializeErrors, and a backslash-redirect bypass) only ship a fix in the v7 line. This app has no SSR, and everyLink/navigate()call site uses hardcoded internal routes — a major-version migration wasn't justified for that reachability.Test plan
go build ./...,go vet ./...,go test ./...all cleanpnpm build,pnpm build-storybook,pnpm type-check,pnpm lint(0 errors, only pre-existing warnings),pnpm test(178 tests passing)pnpm whythat every target package converged to a single patched resolution (no lingering vulnerable duplicate installs)