e6e241746c
fix(deps): audit-driven updates across npm, pnpm, cargo, pip
...
JavaScript lockfiles:
- bezier-kit: vitest 3.2.4→3.2.6, @babel/core 7.29.0→7.29.7,
esbuild 0.27.7→0.27.2, vite 6.4.2→6.4.3
- parametric-learn: vite 8.0.10→8.0.16, form-data 4.0.5→4.0.6
- lytenyte-storage + cluster-dashboard/frontend: vite 6.4.2→6.4.3
Cargo lockfiles:
- leechy-py: pyo3 0.28.3→0.29.0 (RUSTSEC-2026-0176/0177)
- stract: rkyv 0.7.45→0.7.46 (RUSTSEC-2026-0001)
- rs-surface, ene-rds, ene-session-sync: postgres updates
- shared-data/namidb: aws-lc-sys 0.37.1→0.41.0
Python:
- whoogle-search: cryptography 46.0.7→48.0.1 (GHSA-537c-gmf6-5ccf)
Remaining blocked advisories documented in commit body metadata;
require upstream releases or source-level migrations.
2026-06-20 19:00:38 -05:00
Brandon Schneider
65d0ddb12a
fix(deps): update tar to v0.4.46 and refresh npm packages
...
Resolves GHSA-9rg2-7cm8 (PAX header desynchronization) in:
- 2-Search-Space/search/stract/Cargo.lock
- 4-Infrastructure/servo-fetch/Cargo.lock
Note: @ai-sdk/provider-utils in dify-ai-provider nested dep (3.0.25)
has no fix available yet; tracked in GHSA-866g-f22w-33x8
2026-05-30 00:37:43 -05:00
Brandon Schneider
cdc6706e99
fix(servo-fetch): align dom query with smoothie
2026-05-20 23:07:32 -05:00
dependabot[bot]
da3bc4c9f9
Bump the servo-fetch-cargo-minor-patch group
...
Bumps the servo-fetch-cargo-minor-patch group in /4-Infrastructure/servo-fetch with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk ) | `1.5.0` | `1.7.0` |
| [tokio](https://github.com/tokio-rs/tokio ) | `1.52.1` | `1.52.3` |
| [psl](https://github.com/addr-rs/psl ) | `2.1.206` | `2.1.210` |
| [rustls](https://github.com/rustls/rustls ) | `0.23.38` | `0.23.40` |
| [assert_cmd](https://github.com/assert-rs/assert_cmd ) | `2.2.1` | `2.2.2` |
Updates `rmcp` from 1.5.0 to 1.7.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases )
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml )
- [Commits](https://github.com/modelcontextprotocol/rust-sdk/compare/rmcp-v1.5.0...rmcp-v1.7.0 )
Updates `tokio` from 1.52.1 to 1.52.3
- [Release notes](https://github.com/tokio-rs/tokio/releases )
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.52.1...tokio-1.52.3 )
Updates `psl` from 2.1.206 to 2.1.210
- [Release notes](https://github.com/addr-rs/psl/releases )
- [Commits](https://github.com/addr-rs/psl/compare/v2.1.206...v2.1.210 )
Updates `rustls` from 0.23.38 to 0.23.40
- [Release notes](https://github.com/rustls/rustls/releases )
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rustls/rustls/compare/v/0.23.38...v/0.23.40 )
Updates `assert_cmd` from 2.2.1 to 2.2.2
- [Changelog](https://github.com/assert-rs/assert_cmd/blob/master/CHANGELOG.md )
- [Commits](https://github.com/assert-rs/assert_cmd/compare/v2.2.1...v2.2.2 )
---
updated-dependencies:
- dependency-name: rmcp
dependency-version: 1.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: servo-fetch-cargo-minor-patch
- dependency-name: tokio
dependency-version: 1.52.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: servo-fetch-cargo-minor-patch
- dependency-name: psl
dependency-version: 2.1.210
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: servo-fetch-cargo-minor-patch
- dependency-name: rustls
dependency-version: 0.23.40
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: servo-fetch-cargo-minor-patch
- dependency-name: assert_cmd
dependency-version: 2.2.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: servo-fetch-cargo-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit ac4f8088d93d34df8cf2f3e3de0a234c5e1d3bc9)
2026-05-20 23:03:23 -05:00
dependabot[bot]
36fa4291cd
Bump dom_smoothie from 0.16.0 to 0.17.0 in /4-Infrastructure/servo-fetch
...
Bumps [dom_smoothie](https://github.com/niklak/dom_smoothie ) from 0.16.0 to 0.17.0.
- [Release notes](https://github.com/niklak/dom_smoothie/releases )
- [Changelog](https://github.com/niklak/dom_smoothie/blob/main/CHANGELOG.md )
- [Commits](https://github.com/niklak/dom_smoothie/compare/0.16.0...0.17.0 )
---
updated-dependencies:
- dependency-name: dom_smoothie
dependency-version: 0.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit d3825fbe4fa3625513b63eb6aff4ce23afe8b611)
2026-05-20 23:03:23 -05:00
dependabot[bot]
83835af972
Bump dom_query from 0.26.0 to 0.28.0 in /4-Infrastructure/servo-fetch
...
Bumps [dom_query](https://github.com/niklak/dom_query ) from 0.26.0 to 0.28.0.
- [Release notes](https://github.com/niklak/dom_query/releases )
- [Changelog](https://github.com/niklak/dom_query/blob/main/CHANGELOG.md )
- [Commits](https://github.com/niklak/dom_query/compare/0.26.0...0.28.0 )
---
updated-dependencies:
- dependency-name: dom_query
dependency-version: 0.28.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 1c87d275f305ebb0f8d9233d57b9f213c8866705)
2026-05-20 23:02:52 -05:00
Brandon Schneider
eafd19a487
Remediate dependency alert residue
2026-05-11 23:26:12 -05:00
Brandon Schneider
5f88abf618
initial: sovereign research stack (consolidated, weightless, and lfs-optimized)
2026-05-04 18:11:36 -05:00
