Synced from GitHub
fix(deps): update vulnerable dependencies and lockfile resolutions#33226
The main lockfile has 69 vulnerability findings, including four critical advisories. Update DOMPurify, Sharp, stream-json, KaTeX, the Undici catalog, and CodeRabbit config, then refresh affected transitive resolutions within their declared ranges. Claude SDK and TanStack Router already admit the patched dependencies, so neither needs a parent bump.
pnpm audit reports 8 remaining findings: 0 critical, 2 high, 4 moderate, and 2 low. The remaining packages are xml2js, path-to-regexp, uuid, nested KaTeX, Zod 3, deepmerge, glob, and minimatch. Their fixes require compatibility work outside existing ranges or are unavailable; no blanket major-version overrides or alert dismissals are included. Zod 3 remains through Vercel Config and Expo CLI; Zod 4 resolves to 4.6.7.
Validation:
- 167 focused tests passed: server transcript parsing (12), web markdown rendering (50), shared markdown parsing (55), and desktop artifact tooling (50).
- Web, server, and scripts typechecks passed; marketing build passed.
- DOMPurify checks preserve safe markup and remove event handlers and JavaScript URLs.
- Frozen-lockfile installation, formatting, lint, and the commit hook's dependency checks passed.
No application source or UI behavior was changed; screenshots are not applicable. Browser and native mobile verification were not run.
Implemented with GPT-6.1 Sol through the Codex harness in T3 Code.
Checks
1 failing · 26 successful · 8 skipped
Failing1
- CodeRabbitGitHubCancelled
Added 1 commit
- fix(deps): update vulnerable dependencies and lockfile resolutionsc32edab
Synced from GitHub
Approvability
Verdict: Approved at c32edab
Macroscope's review found this PR approvable — Updates the server's undici dependency from 8.11.2 to 8.12.4 without changing HTTP configuration or product defaults. The scoped patch update presents no evident material risk requiring human judgment.
You can add or adjust custom eligibility rules. Learn more.
Synced from GitHub
Thread transfer impact
✅ Thread transfer remains within every enforced ceiling.
| Provider | Metric | Main baseline | This PR | Impact | PR ceiling | |
|---|---|---|---|---|---|---|
| Codex | Total thread wire | 5.0 KiB | 5.0 KiB | 0 B (0.0%) | 6.8 KiB | ✅ |
| Codex | Thread snapshot wire | 3.8 KiB | 3.8 KiB | 0 B (0.0%) | 4.9 KiB | ✅ |
| Codex | Live turn WebSocket wire | 1.2 KiB | 1.2 KiB | 0 B (0.0%) | 2.0 KiB | ✅ |
| Codex | Live turn WebSocket decoded | 21.5 KiB | 21.5 KiB | 0 B (0.0%) | 24.4 KiB | ✅ |
| Codex | Live turn messages | 1 | 1 | 0 (0.0%) | 8 | ✅ |
| Claude | Total thread wire | 5.0 KiB | 5.0 KiB | 0 B (0.0%) | 6.8 KiB | ✅ |
| Claude | Thread snapshot wire | 3.8 KiB | 3.8 KiB | 0 B (0.0%) | 4.9 KiB | ✅ |
| Claude | Live turn WebSocket wire | 1.2 KiB | 1.2 KiB | 0 B (0.0%) | 2.0 KiB | ✅ |
| Claude | Live turn WebSocket decoded | 21.9 KiB | 21.9 KiB | 0 B (0.0%) | 24.4 KiB | ✅ |
| Claude | Live turn messages | 1 | 1 | 0 (0.0%) | 8 | ✅ |
Baseline: 60514be · PR result: c32edab · Source CI: success
Scenario and decoded snapshot size
10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
- Codex decoded thread snapshot: 108.5 KiB
- Claude decoded thread snapshot: 108.8 KiB
Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.