From 902873cec08ce6d9ec8bed8e42f55870916f37c3 Mon Sep 17 00:00:00 2001 From: Drew Stone Date: Thu, 3 Sep 2026 02:43:51 -0700 Subject: [PATCH 1/2] wip(deps): partial Dependabot remediation, interrupted 2026-09-03 before gates ran --- package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 4aa264e5..2645459b 100644 --- a/package.json +++ b/package.json @@ -237,7 +237,7 @@ "overrides": { "@arizeai/openinference-core>@opentelemetry/core": "^2.10.0", "esbuild@>=0.27.3 <0.28.1": "^0.28.1", - "fast-uri": "3.1.5", + "fast-uri": "3.1.6", "js-yaml": "4.3.1", "postcss@<8.5.18": "^8.5.18", "vite@>=7.0.0 <=7.3.4": "^7.3.5", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c769229d..77557e54 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: '@arizeai/openinference-core>@opentelemetry/core': ^2.10.0 esbuild@>=0.27.3 <0.28.1: ^0.28.1 - fast-uri: 3.1.5 + fast-uri: 3.1.6 js-yaml: 4.3.1 postcss@<8.5.18: ^8.5.18 vite@>=7.0.0 <=7.3.4: ^7.3.5 @@ -1286,8 +1286,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.6: + resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} @@ -2509,7 +2509,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.6 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -2676,7 +2676,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.5: {} + fast-uri@3.1.6: {} fdir@6.5.0(picomatch@4.0.5): optionalDependencies: From 13dec2a771d18dbdf02b77b01253c2772b49b328 Mon Sep 17 00:00:00 2001 From: Drew Stone Date: Thu, 3 Sep 2026 08:17:13 -0700 Subject: [PATCH 2/2] fix(deps): resolve open Dependabot alerts Alerts #53 and #54 flag fast-uri below 3.1.6, both high severity. Commit 902873c already bumped fast-uri to 3.1.6 in package.json and pnpm-lock.yaml. This commit regenerates the pinned analyst-benchmark dependency-lock digest with `pnpm analyst:pin`. The digest pins pnpm-lock.yaml content and went stale after the bump, failing `pnpm run verify:package`. --- src/analyst/benchmark-implementation.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/analyst/benchmark-implementation.ts b/src/analyst/benchmark-implementation.ts index a66c1805..b2973f2d 100644 --- a/src/analyst/benchmark-implementation.ts +++ b/src/analyst/benchmark-implementation.ts @@ -10,7 +10,7 @@ export const ANALYST_BENCHMARK_DEPENDENCY_LOCK_FILES = Object.freeze([ ]) export const ANALYST_BENCHMARK_DEPENDENCY_LOCK_SHA256 = - 'e859e07e195eb64386e00c81b67a49cc627a5d138ed90a1fac537aa956085b17' + '6f800044ae1736643c6834187c5378dddda1ece3e7a59b89de33e6268e1bef67' /** The published benchmark evidence was produced at this package version, by * the retired one-shot direct runner, before trace analysts moved to the