chore(deps): bump minor versions for vulnerability fixes#925
Merged
Conversation
Closes Dependabot alerts bsv-blockchain#84 (critical memory-safety in v5.8.0) and bsv-blockchain#86 (SQL injection via dollar-quoted placeholder confusion). pgx is used in production blockchain and UTXO SQL stores.
Closes Dependabot alerts bsv-blockchain#72 and bsv-blockchain#71. EventStream decoder DoS panic in v1.7.4 is patched in v1.7.10; s3 service module updated to v1.96.4 (latest patch in the v1.96.x line).
Closes Dependabot alerts bsv-blockchain#78, bsv-blockchain#77, bsv-blockchain#76. otel/sdk v1.42.0 kenv PATH hijack (BSD-only, non-exploitable on Linux); otlptracehttp and otlpmetrichttp unbounded HTTP response body reads patched in v1.43.0. otlpmetrichttp jump v1.35.0 -> v1.43.0 verified by build + util/tracing test suite (29 tests pass).
Closes Dependabot alert bsv-blockchain#83. moby/spdystream DoS via CRI in v0.5.0 patched in v0.5.1. Indirect dep. Note: moby/buildkit bumps (alerts bsv-blockchain#64, bsv-blockchain#65) deferred. v0.28.1 pulls docker/buildx v0.29.1 which uses moby/moby/client types incompatible with the docker/docker types still used elsewhere in the teranode dep graph (via testcontainers -> docker/compose -> buildx). Resolving the chain requires a testcontainers v0.40 -> v0.42 migration that breaks nat.Port -> network.Port across ~10 source files. Tracked in separate GH issue.
Closes Dependabot alert bsv-blockchain#49. svgo billion-laughs DoS (GHSA-xpqw-6gx7-v673) patched in v4.0.1. svgo is a build-time devDependency used by @poppanator/sveltekit-svg. Verified: npm install + npm run build + npm run test:unit (29 tests pass). playwright (test:integration) not run locally; CI covers it.
Contributor
|
🤖 Claude Code Review Status: Complete Current Review: No issues found. This PR applies security-focused dependency bumps that address critical vulnerabilities: Summary:
Verification claims matched:
Risk assessment:
The dependency updates are correctly scoped, well-documented, and follow project security practices. |
|
Contributor
Benchmark Comparison ReportBaseline: Current: Summary
All benchmark results (sec/op)
Threshold: >10% with p < 0.05 | Generated: 2026-05-21 17:16 UTC |
icellan
approved these changes
May 22, 2026
freemans13
approved these changes
May 22, 2026
This was referenced May 22, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies 9 non-breaking dependency bumps identified by the 2026-05-21 vulnerability triage as
fix_class=dep-bump-minor. Closes the following Dependabot alerts:6 commits, one per ecosystem group + a final
go mod tidy.Deferred from this PR
testcontainers-gov0.40 → v0.42 migration that breaksnat.Port→network.Portacross ~10 source files intest/. Tracked separately — see follow-up issue (deps: moby/buildkit v0.28+ upgrade requires testcontainers-go nat.Port migration #926).Test plan
Full AGENTS.md verification battery ran clean:
go build ./...go test ./...— 8044 tests pass in 148 packagesgo test -race ./...— zeroAction:"fail"entriesgo vet ./...— only 4 pre-existing issues intest/utils/(unrelated to bumps)golangci-lint runstaticcheck ./...govulncheck ./...— all 8 bumped Go packages no longer flagged; remaining vulns are Go stdlib (needs 1.26.3) + deferred docker + libp2p (no fix)gosec ./...— informational (717 pre-existing findings, not introduced by bumps)cd ui/dashboard && npm install && npm run build && npm run test:unit— 29 vitest tests passPer-group additional verification:
go test -race ./stores/blockchain/sql/... ./stores/utxo/sql/...— 735 tests passgo test -race ./stores/blob/...— 281 tests passgo test -race ./util/tracing/...— 29 tests passNotes
go getbecausego mod tidyalone does not always pull patched versions through direct-dep transitive closure.go mod tidycleaned up the indirect block (44 line removals in go.sum).otlpmetrichttpjumped 8 minor versions (v1.35.0 → v1.43.0); verified by tracing test suite.