fix(deps): batch security and dependency upgrades - #56
Merged
Conversation
Bumps the gomod group in /sdk/go with 1 update: [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt). Updates `github.com/golang-jwt/jwt/v5` from 5.2.2 to 5.3.1 - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Commits](golang-jwt/jwt@v5.2.2...v5.3.1) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v5 dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gomod ... Signed-off-by: dependabot[bot] <support@github.com>
Updates the requirements on [pyjwt](https://github.com/jpadilla/pyjwt), [cryptography](https://github.com/pyca/cryptography), [httpx](https://github.com/encode/httpx), [pytest](https://github.com/pytest-dev/pytest), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio), [pytest-httpx](https://github.com/Colin-b/pytest_httpx), [mypy](https://github.com/python/mypy) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version. Updates `pyjwt` to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.8.0...2.13.0) Updates `cryptography` to 49.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@42.0.0...49.0.0) Updates `httpx` to 0.28.1 - [Release notes](https://github.com/encode/httpx/releases) - [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md) - [Commits](encode/httpx@0.27.0...0.28.1) Updates `pytest` to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.0.0...9.1.1) Updates `pytest-asyncio` to 1.4.0 - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](pytest-dev/pytest-asyncio@v0.23.0...v1.4.0) Updates `pytest-httpx` to 0.36.2 - [Release notes](https://github.com/Colin-b/pytest_httpx/releases) - [Changelog](https://github.com/Colin-b/pytest_httpx/blob/develop/CHANGELOG.md) - [Commits](Colin-b/pytest_httpx@v0.30.0...0.36.2) Updates `mypy` to 2.3.0 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v1.10.0...v2.3.0) Updates `ruff` to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@v0.4.0...0.16.0) --- updated-dependencies: - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 49.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: httpx dependency-version: 0.28.1 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development dependency-group: pip - dependency-name: pytest-asyncio dependency-version: 1.4.0 dependency-type: direct:development dependency-group: pip - dependency-name: pytest-httpx dependency-version: 0.36.2 dependency-type: direct:development dependency-group: pip - dependency-name: mypy dependency-version: 2.3.0 dependency-type: direct:development dependency-group: pip - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the cargo group with 7 updates in the /sdk/linux directory: | Package | From | To | | --- | --- | --- | | [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.0` | | [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` | | [digest](https://github.com/RustCrypto/traits) | `0.10.7` | `0.11.3` | | [rand](https://github.com/rust-random/rand) | `0.8.7` | `0.10.2` | | [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.19` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` | | [p256](https://github.com/RustCrypto/elliptic-curves) | `0.13.2` | `0.14.0` | Bumps the cargo group with 5 updates in the /sdk/rust directory: | Package | From | To | | --- | --- | --- | | [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.0` | | [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` | | [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.19` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` | | [hmac](https://github.com/RustCrypto/MACs) | `0.12.1` | `0.13.0` | Updates `base64` from 0.22.1 to 0.23.0 - [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md) - [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.0) Updates `sha2` from 0.10.9 to 0.11.0 - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0) Updates `digest` from 0.10.7 to 0.11.3 - [Commits](RustCrypto/traits@digest-v0.10.7...digest-v0.11.3) Updates `rand` from 0.8.7 to 0.10.2 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](rust-random/rand@0.8.7...0.10.2) Updates `thiserror` from 1.0.69 to 2.0.19 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@1.0.69...2.0.19) Updates `jsonwebtoken` from 10.4.0 to 11.0.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0) Updates `p256` from 0.13.2 to 0.14.0 - [Commits](RustCrypto/elliptic-curves@p256/v0.13.2...p256/v0.14.0) Updates `base64` from 0.22.1 to 0.23.0 - [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md) - [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.0) Updates `sha2` from 0.10.9 to 0.11.0 - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0) Updates `thiserror` from 1.0.69 to 2.0.19 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@1.0.69...2.0.19) Updates `jsonwebtoken` from 10.4.0 to 11.0.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0) Updates `hmac` from 0.12.1 to 0.13.0 - [Commits](RustCrypto/MACs@hmac-v0.12.1...hmac-v0.13.0) --- updated-dependencies: - dependency-name: base64 dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: digest dependency-version: 0.11.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: rand dependency-version: 0.10.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: thiserror dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: jsonwebtoken dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: p256 dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: base64 dependency-version: 0.23.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: thiserror dependency-version: 2.0.19 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: jsonwebtoken dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: hmac dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the pub group in /sdk/flutter with 3 updates: [flutter_lints](https://github.com/flutter/packages/tree/main/packages), [flutter_secure_storage](https://github.com/mogol/flutter_secure_storage) and [flutter_web_auth_2](https://github.com/ThexXTURBOXx/flutter_web_auth_2). Updates `flutter_lints` from 5.0.0 to 6.0.0 - [Commits](https://github.com/flutter/packages/commits/flutter_lints-v6.0.0/packages) Updates `flutter_secure_storage` from 9.2.4 to 10.3.1 - [Release notes](https://github.com/mogol/flutter_secure_storage/releases) - [Commits](juliansteenbakker/flutter_secure_storage@v9.2.4...v10.3.1) Updates `flutter_web_auth_2` from 4.1.0 to 5.0.3 - [Release notes](https://github.com/ThexXTURBOXx/flutter_web_auth_2/releases) - [Commits](ThexXTURBOXx/flutter_web_auth_2@4.1.0...5.0.3) --- updated-dependencies: - dependency-name: flutter_lints dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pub - dependency-name: flutter_secure_storage dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pub - dependency-name: flutter_web_auth_2 dependency-version: 5.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pub ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps Microsoft.Extensions.Http from 9.0.0 to 10.0.10 Bumps Microsoft.Extensions.Logging.Abstractions from 9.0.0 to 10.0.10 Bumps Microsoft.IdentityModel.Tokens from 8.4.0 to 8.22.0 Bumps System.IdentityModel.Tokens.Jwt from 8.4.0 to 8.22.0 --- updated-dependencies: - dependency-name: Microsoft.Extensions.Http dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: nuget - dependency-name: Microsoft.IdentityModel.Tokens dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: System.IdentityModel.Tokens.Jwt dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: Microsoft.IdentityModel.Tokens dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget - dependency-name: System.IdentityModel.Tokens.Jwt dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the gradle group in /sdk/android with 15 updates: | Package | From | To | | --- | --- | --- | | androidx.core:core-ktx | `1.16.0` | `1.19.0` | | androidx.browser:browser | `1.8.0` | `1.10.0` | | androidx.security:security-crypto | `1.1.0-alpha06` | `1.1.0` | | androidx.biometric:biometric | `1.2.0-alpha05` | `1.4.0-alpha07` | | [org.jetbrains.kotlinx:kotlinx-coroutines-android](https://github.com/Kotlin/kotlinx.coroutines) | `1.9.0` | `1.11.0` | | [com.squareup.okhttp3:okhttp](https://github.com/square/okhttp) | `4.12.0` | `5.4.0` | | [org.jetbrains.kotlinx:kotlinx-serialization-json](https://github.com/Kotlin/kotlinx.serialization) | `1.8.1` | `1.11.0` | | [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `9.40` | `10.9.1` | | [org.jetbrains.kotlinx:kotlinx-coroutines-test](https://github.com/Kotlin/kotlinx.coroutines) | `1.9.0` | `1.11.0` | | [com.squareup.okhttp3:mockwebserver](https://github.com/square/okhttp) | `4.12.0` | `5.4.0` | | androidx.test.ext:junit | `1.2.1` | `1.3.0` | | androidx.test.espresso:espresso-core | `3.6.1` | `3.7.0` | | com.android.library | `8.7.3` | `9.3.1` | | [org.jetbrains.kotlin.android](https://github.com/JetBrains/kotlin) | `2.1.21` | `2.4.10` | | [org.jetbrains.kotlin.plugin.serialization](https://github.com/JetBrains/kotlin) | `2.1.21` | `2.4.10` | Updates `androidx.core:core-ktx` from 1.16.0 to 1.19.0 Updates `androidx.browser:browser` from 1.8.0 to 1.10.0 Updates `androidx.security:security-crypto` from 1.1.0-alpha06 to 1.1.0 Updates `androidx.biometric:biometric` from 1.2.0-alpha05 to 1.4.0-alpha07 Updates `org.jetbrains.kotlinx:kotlinx-coroutines-android` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/Kotlin/kotlinx.coroutines/releases) - [Changelog](https://github.com/Kotlin/kotlinx.coroutines/blob/master/CHANGES.md) - [Commits](Kotlin/kotlinx.coroutines@1.9.0...1.11.0) Updates `com.squareup.okhttp3:okhttp` from 4.12.0 to 5.4.0 - [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md) - [Commits](lysine-dev/okhttp@parent-4.12.0...parent-5.4.0) Updates `org.jetbrains.kotlinx:kotlinx-serialization-json` from 1.8.1 to 1.11.0 - [Release notes](https://github.com/Kotlin/kotlinx.serialization/releases) - [Changelog](https://github.com/Kotlin/kotlinx.serialization/blob/master/CHANGELOG.md) - [Commits](Kotlin/kotlinx.serialization@v1.8.1...v1.11.0) Updates `com.nimbusds:nimbus-jose-jwt` from 9.40 to 10.9.1 - [Changelog](https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt) - [Commits](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.9.1..9.40) Updates `org.jetbrains.kotlinx:kotlinx-coroutines-test` from 1.9.0 to 1.11.0 - [Release notes](https://github.com/Kotlin/kotlinx.coroutines/releases) - [Changelog](https://github.com/Kotlin/kotlinx.coroutines/blob/master/CHANGES.md) - [Commits](Kotlin/kotlinx.coroutines@1.9.0...1.11.0) Updates `com.squareup.okhttp3:mockwebserver` from 4.12.0 to 5.4.0 - [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md) - [Commits](lysine-dev/okhttp@parent-4.12.0...parent-5.4.0) Updates `androidx.test.ext:junit` from 1.2.1 to 1.3.0 Updates `androidx.test.espresso:espresso-core` from 3.6.1 to 3.7.0 Updates `com.android.library` from 8.7.3 to 9.3.1 Updates `org.jetbrains.kotlin.android` from 2.1.21 to 2.4.10 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.1.21...v2.4.10) Updates `org.jetbrains.kotlin.plugin.serialization` from 2.1.21 to 2.4.10 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v2.1.21...v2.4.10) --- updated-dependencies: - dependency-name: androidx.core:core-ktx dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: androidx.browser:browser dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: androidx.security:security-crypto dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gradle - dependency-name: androidx.biometric:biometric dependency-version: 1.4.0-alpha07 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: org.jetbrains.kotlinx:kotlinx-coroutines-android dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: com.squareup.okhttp3:okhttp dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gradle - dependency-name: org.jetbrains.kotlinx:kotlinx-serialization-json dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: com.nimbusds:nimbus-jose-jwt dependency-version: 10.9.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gradle - dependency-name: org.jetbrains.kotlinx:kotlinx-coroutines-test dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: com.squareup.okhttp3:mockwebserver dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gradle - dependency-name: androidx.test.ext:junit dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: androidx.test.espresso:espresso-core dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: com.android.library dependency-version: 9.3.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gradle - dependency-name: org.jetbrains.kotlin.android dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: org.jetbrains.kotlin.plugin.serialization dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle ... Signed-off-by: dependabot[bot] <support@github.com>
…od-f2a935cd04' into fix/deps-security-batch
…171eddb2' into fix/deps-security-batch
…-dcddfa4c30' into fix/deps-security-batch
…1d8314ef5' into fix/deps-security-batch
…t-d0b0057a03' into fix/deps-security-batch
…adle-2f126cba1e' into fix/deps-security-batch
Apply Dependabot npm/action/SDK updates, patch image-size DoS loops, fix CodeQL ReDoS on issuer slash stripping, migrate TanStack Table to the v9 legacy entry, and align Node 26 / wrangler peer types. Signed-off-by: StringKE <stringke.me@gmail.com>
This was referenced Aug 11, 2026
chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.2 to 5.3.1 in /sdk/go in the gomod group
#30
Closed
Dependabot had pinned >=49,<50 which still matches the vulnerable range fixed in cryptography 50.0.0 (GHSA-g6cj-pr64-35w5). Signed-off-by: StringKE <stringke.me@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
image-size@1.2.1ICNS/box parsers against infinite-loop DoS (GHSA for ICNS/JXL/HEIF; no upstream release yet).js/polynomial-redoson issuer trailing-slash stripping inpackages/react-native.@tanstack/react-tableto v9 via the/legacycompatibility entry.@cloudflare/vite-pluginpeer requirement and Node 26Uint8Arraytyping.Supersedes
Dependabot PRs: #30 #31 #32 #33 #34 #35 #45 #46 #47 #48 #49 #50 #51 #52 #54 #55
Deferred (needs dedicated migration): #53 TypeScript 7.
Verification
pnpm typecheckPASSpnpm testPASS@xid-kit/web-uitypecheck/test/build PASS@xid-kit/electrontypecheck PASSSecurity alerts
image-size: runtime mitigated viapatches/image-size@1.2.1.patch(metro transitive only). Alert cannot auto-close until upstream ships a patched release.