Repository navigation
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates multiple example projects to address Dependabot alerts by bumping dependencies across Node.js, Rust, Python, Go, and Spin-based components.
Changes:
- Updated assorted npm dependencies/lockfiles (e.g., body-parser/qs, Vite/Rollup/esbuild, Playwright, debug/follow-redirects).
- Updated Rust dependencies/lockfiles, including Spin/WASI-related changes (wasm32-wasi → wasm32-wasip1) and Spin SDK version changes.
- Updated Python and Go module dependencies to newer patched versions.
Reviewed changes
Copilot reviewed 18 out of 33 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| webhook-github-node/package-lock.json | Bumps body-parser/qs/iconv-lite transitive deps. |
| spin-wagi-http/spin.toml | Switches Rust component build/output to wasm32-wasip1. |
| spin-wagi-http/goodbye-rust/Cargo.toml | Moves Spin SDK dependency to crates.io (spin-sdk = "2.2"). |
| spin-wagi-http/goodbye-rust/Cargo.lock | Rust dependency lockfile refresh after dependency updates. |
| spin-wagi-http/goodbye-rust/.cargo/config.toml | Removes default build target config. |
| spin-wagi-http/Dockerfile | Updates Rust base image, Spin version, WASI target, and disables telemetry during build. |
| python3.12-flask3.0-sqlite/requirements.txt | Updates Flask minimum version. |
| prisma-expressjs4.19-node18/package.json | Raises Express minimum version constraint. |
| node21-sveltekit/package.json | Adds overrides for cookie. |
| node21-remix/package.json | Updates typescript-eslint tooling and adds tar override. |
| node21-nextjs/package.json | Major dependency range updates (React/Next/Eslint). |
| node-vite-vanilla/package-lock.json | Updates Vite/Rollup/esbuild related lockfile entries. |
| node-playwright-webkit/package.json | Updates Playwright packages. |
| node-playwright-firefox/package.json | Updates Playwright packages. |
| node-playwright-chromium/package-lock.json | Updates Playwright Chromium lockfile entries and package name. |
| node-express-puppeteer/package.json | Updates Express and Nodemon. |
| nginx-vite-vanilla/package-lock.json | Updates Vite/Rollup/esbuild related lockfile entries and lockfile package name. |
| mcp-server-simple/requirements.txt | Bumps several Python dependencies (Authlib/cryptography/fastmcp/mcp/etc.). |
| mcp-server-arxiv/requirements.txt | Bumps several Python dependencies (Authlib/cryptography/fastmcp/mcp/etc.). |
| httpserver-rust1.81-rocket0.5/Cargo.lock | Rust dependency lockfile refresh. |
| httpserver-python3.12-flask3.0/requirements.txt | Updates Flask minimum version. |
| httpserver-go1.22-redis/go.sum | Updates checksums for module bumps. |
| httpserver-go1.22-redis/go.mod | Bumps go-redis and related indirect deps. |
| http-rust-1.79-axum-scale-to-zero/Cargo.lock | Rust dependency lockfile refresh. |
| flask3.0-python3.12-sqlite3/requirements.txt | Updates Flask minimum version. |
| duckdb-go1.21/src/go.sum | Updates checksums for module bumps. |
| duckdb-go1.21/src/go.mod | Bumps mapstructure indirect dep. |
| chromium-cdp/chromium-cdp/package-lock.json | Updates debug/follow-redirects/playwright lockfile entries. |
Files not reviewed (6)
- chromium-cdp/chromium-cdp/package-lock.json: Language not supported
- nginx-vite-vanilla/package-lock.json: Language not supported
- node-playwright-chromium/package-lock.json: Language not supported
- node-vite-ssr-vanilla/package-lock.json: Language not supported
- node-vite-vanilla/package-lock.json: Language not supported
- webhook-github-node/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -1 +1 @@ | |||
| flask>=3.0,<3.1 | |||
| flask>=3.1.3 | |||
There was a problem hiding this comment.
This example directory name suggests Flask 3.0, but the requirement is now flask>=3.1.3. Please align the dependency constraint with the example name (or rename the directory/docs) to avoid confusion for users.
Suggested change
| flask>=3.1.3 | |
| flask>=3.0,<3.1 |
| "next": ">=14.1.1" | ||
| "react": "^19", | ||
| "react-dom": "^19", | ||
| "next": ">=15.5.14" |
There was a problem hiding this comment.
Using a bare lower bound for Next (>=15.5.14) makes installs non-deterministic and can pull in future major versions. Consider switching to a bounded range (e.g. ^15.5.14) and/or adding a lockfile to keep dependency resolution stable.
| "eslint": "^8", | ||
| "eslint-config-next": "14.1.1" | ||
| "eslint": "^9", | ||
| "eslint-config-next": ">=15.5.14" |
There was a problem hiding this comment.
eslint-config-next is set to >=15.5.14, which can float to future major versions and break linting unexpectedly. Consider using a bounded range (e.g. ^15.5.14) so upgrades remain intentional.
Suggested change
| "eslint-config-next": ">=15.5.14" | |
| "eslint-config-next": "^15.5.14" |
| @@ -10,7 +10,7 @@ | |||
| "@prisma/client": "5.7.1", | |||
| "copy-webpack-plugin": "^12.0.2", | |||
| "ejs": "^3.1.9", | |||
| "express": ">=4.19.2", | |||
| "express": ">=4.20.0", | |||
There was a problem hiding this comment.
Using ">=4.20.0" allows npm to resolve Express 5+ in the future, which is likely a breaking change. If the intent is to stay on Express 4 while addressing advisories, use a bounded range (e.g. ^4.20.0) or pin to a specific 4.x version.
Suggested change
| "express": ">=4.20.0", | |
| "express": "^4.20.0", |
| @@ -1,2 +1,2 @@ | |||
| flask>=3.0,<3.1 | |||
| flask>=3.1.3 | |||
There was a problem hiding this comment.
This example directory is labeled flask3.0, but the requirement now allows Flask 3.1.x+. To avoid confusion and keep the example reproducible, either update the directory/README naming to match, or constrain Flask to the intended minor line (e.g. <3.2 or <3.1 depending on the goal).
Suggested change
| flask>=3.1.3 | |
| flask>=3.0,<3.1 |
Contributor
There was a problem hiding this comment.
I think it is preferred to just update the directory name
| @@ -1 +1 @@ | |||
| flask>=3.0,<3.1 | |||
| flask>=3.1.3 | |||
There was a problem hiding this comment.
This example directory is labeled flask3.0, but the requirement now allows Flask 3.1.x+. Consider renaming the example or constraining the Flask minor version to keep the directory name and dependency intent consistent.
Suggested change
| flask>=3.1.3 | |
| flask>=3.0,<3.1 |
Contributor
|
Some comments for you to fix, we can merge after and see how many security problems remain |
| @@ -1,6 +1,6 @@ | |||
| # This file is automatically @generated by Cargo. | |||
Contributor
There was a problem hiding this comment.
I couldn't build this server with rust 1.81 I needed at least 1.88
| @@ -1,2 +1,2 @@ | |||
| flask>=3.0,<3.1 | |||
| flask>=3.1.3 | |||
Contributor
There was a problem hiding this comment.
I think it is preferred to just update the directory name
Contributor
|
rebase and we merge? |
dragosgheorghioiu
force-pushed
the
razvand/fix/dependabot
branch
6 times, most recently
from
April 7, 2026 09:50
8c87158 to
4f72e97
Compare
…r CVE Update flask version constraint from >=3.0,<3.1 to >=3.1.3 across all three Flask examples to address the low-severity vulnerability where Flask sessions do not add Vary: Cookie header when accessed in some ways. Affected examples: flask3.0-python3.12-sqlite3, httpserver-python3.12-flask3.0, python3.12-flask3.0-sqlite. Resolves dependabot alerts #299, #300, #303. Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update the following packages to fix security vulnerabilities: - Authlib 1.6.5 -> 1.6.9 (critical: JWS JWK Header Injection, high: alg:none bypass, Bleichenbacher, OIDC hash binding, medium: account takeover) - cryptography 46.0.3 -> 46.0.5 (high: SECT curve subgroup attack) - fastmcp 2.13.2 -> 2.14.5 (high: OAuth proxy token reuse, MCP CVE-2025-66416) - mcp 1.23.1 -> 1.26.0 (required by fastmcp 2.14.x) - PyJWT 2.10.1 -> 2.12.1 (high: unknown crit header extensions) - python-multipart 0.0.20 -> 0.0.22 (high: arbitrary file write) - urllib3 2.5.0 -> 2.6.3 (high: decompression bomb bypass, streaming API issues) Note: diskcache 5.6.3 has no fix available (alert #227). Resolves dependabot alerts #175, #176, #184, #190, #198, #209, #225, #275, #283, #291, #293, #295, #297. Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update the following packages to fix security vulnerabilities: - Authlib 1.6.5 -> 1.6.9 (critical: JWS JWK Header Injection, high: alg:none bypass, Bleichenbacher, OIDC hash binding, medium: account takeover) - cryptography 46.0.3 -> 46.0.5 (high: SECT curve subgroup attack) - fastmcp 2.13.2 -> 2.14.5 (high: OAuth proxy token reuse, MCP CVE-2025-66416) - mcp 1.23.1 -> 1.26.0 (required by fastmcp 2.14.x) - PyJWT 2.10.1 -> 2.12.1 (high: unknown crit header extensions) - python-multipart 0.0.20 -> 0.0.22 (high: arbitrary file write) - urllib3 2.5.0 -> 2.6.3 (high: decompression bomb bypass, streaming API issues) Note: diskcache 5.6.3 has no fix available (alert #226). Resolves dependabot alerts #177, #178, #183, #189, #197, #208, #224, #274, #282, #290, #292, #294, #296. Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update Next.js from >=14.1.1 to >=15.5.14 to fix all 16 security alerts. Also update react and react-dom to ^19, @types/react and @types/react-dom to ^19, eslint to ^9, and eslint-config-next to >=15.5.14 for compatibility with the Next.js 15+ ecosystem. Fixes alerts: #105, #106, #107, #108, #109, #120, #136, #147, #148, #152, #173, #174, #211, #214, #302, #306 Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update Express from >=4.19.2 to >=4.20.0 to fix XSS vulnerability via malicious URL in res.redirect(). Fixes alert: #180 Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update playwright in node-playwright-chromium (lockfile 1.47.0->1.58.2), node-playwright-firefox (1.49.0->1.55.1), node-playwright-webkit (1.49.0->1.55.1), and chromium-cdp (lockfile 1.47.0->1.58.2) to fix high severity SSRF vulnerability in browser launch websocket URL. Fixes alerts: #153, #154, #155, #298 Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update github.com/redis/go-redis/v9 from v9.5.1 to v9.18.0 to fix low severity vulnerability in Redis connection handling. Fixes alert: #179 Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update Cargo.lock to fix: - Alert #218: bytes <1.11.1 (medium severity) Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
Update Cargo.lock to fix: - Alert #221: bytes <1.11.1 (medium severity) Note: Alert #30 (spin-sdk <2.4.3, critical) cannot be fixed. The patched version 2.4.3 refers to the Spin CLI release, not the spin-sdk crate. The SDK crate on crates.io only has v2.2.0 as the latest v2.x, and the vulnerability is in the Spin runtime's network sandbox, not the SDK itself. Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
…vulnerabilities Run npm update to regenerate lockfile with patched dependencies. - Alert #122: vite <6.2.6 (medium severity) - Alert #123: vite <6.2.7 (medium severity) - Alert #139: vite <6.3.6 (low severity) - Alert #142: vite <6.3.6 (low severity) - Alert #158: vite <6.4.1 (medium severity) - Alert #257: rollup <4.59.0 (high severity) Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
…ulnerabilities Run npm update to regenerate lockfile with patched dependencies. - Alert #126: vite <6.2.6 (medium severity) - Alert #127: vite <6.2.7 (medium severity) - Alert #140: vite <6.3.6 (low severity) - Alert #143: vite <6.3.6 (low severity) - Alert #159: vite <6.4.1 (medium severity) - Alert #259: rollup <4.59.0 (high severity) Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
…vulnerabilities Run npm update to regenerate lockfile with patched dependencies. - Alert #124: vite <6.2.6 (medium severity) - Alert #125: vite <6.2.7 (medium severity) - Alert #130: on-headers <1.1.0 (low severity) - Alert #141: vite <6.3.6 (low severity) - Alert #144: vite <6.3.6 (low severity) - Alert #160: vite <6.4.1 (medium severity) - Alert #171: body-parser <2.2.1 (medium severity) - Alert #187: qs <6.14.1 (medium severity) - Alert #230: qs <6.14.2 (low severity) - Alert #258: rollup <4.59.0 (high severity) Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
…ockfile Update express from ^4.19.2 to ^4.21.0 and nodemon from ^2.0.22 to ^3.1.0. Regenerate package-lock.json to fix transitive dependencies. - Alert #38: path-to-regexp <0.1.10 (high severity) - Alert #39: body-parser <1.20.3 (high severity) - Alert #40: express <4.20.0 (low severity) - Alert #41: serve-static <1.16.0 (low severity) - Alert #42: send <0.19.0 (low severity) - Alert #64: cookie <0.7.0 (low severity) - Alert #75: path-to-regexp <0.1.12 (high severity) - Alert #88: tar-fs <3.0.7 (high severity) - Alert #102: tar-fs <3.0.9 (high severity) - Alert #129: on-headers <1.1.0 (low severity) - Alert #149: tar-fs <3.1.1 (high severity) - Alert #167: js-yaml <4.1.1 (medium severity) - Alert #185: qs <6.14.1 (medium severity) - Alert #228: qs <6.14.2 (low severity) - Alert #254: basic-ftp <5.2.0 (critical severity) - Alert #273: minimatch <3.1.3 (high severity) Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
…o fix multiple vulnerabilities Regenerate lockfile to fix: flatted, devalue, js-yaml, minimatch, vite, rollup vulnerabilities. Add cookie override to ^0.7.0 to fix cookie out-of-bounds character vulnerability. Remaining unfixable: svelte SSR issues (requires Svelte 5, incompatible with Node 21), esbuild dev server (requires vite 6.2+, incompatible with @sveltejs/vite-plugin-svelte@3). Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
…4.3 to fix CVE - Update spin-sdk from git dependency (v2.1.0) to crates.io v2.2.0 - Upgrade Rust from 1.75.0 to 1.87.0 and Spin from 2.1.0 to 2.4.3 - Migrate wasm target from wasm32-wasi to wasm32-wasip1 - Remove .cargo/config.toml (target now specified in spin.toml) - Set SPIN_TELEMETRY_DISABLED=1 for Spin v2.4.3 build compatibility - Regenerate Cargo.lock with updated dependencies Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
… multiple vulnerabilities - Update @typescript-eslint/eslint-plugin and parser to ^8.0.0 - Add tar override (^7.5.11) to fix path traversal vulnerabilities - Regenerate package-lock.json fixing: vite, undici, tar, tar-fs, rollup, cookie, qs, lodash, react-router, @remix-run/react, @remix-run/node, @remix-run/server-runtime, @remix-run/router, minimatch, js-yaml, glob, on-headers, flatted vulnerabilities - Remaining unfixable: esbuild (dev dep, no fix available), estree-util-value-to-estree (ESM/CJS incompatibility) Signed-off-by: Razvan Deaconescu <razvand@unikraft.io>
dragosgheorghioiu
force-pushed
the
razvand/fix/dependabot
branch
from
April 7, 2026 14:13
4f72e97 to
5fe1d8f
Compare
Signed-off-by: Dragos Gheorghioiu <dragosg@unikraft.com>
dragosgheorghioiu
force-pushed
the
razvand/fix/dependabot
branch
from
April 8, 2026 14:11
5fe1d8f to
33203c5
Compare
Contributor
|
Is this ready to merge? |
Contributor
Author
|
@adinamariav , @craciunoiuc , @dragosgheorghioiu , this is now just too old to make sense. There have been a lot of updates to the I'm closing this. @danielvallance , could you please also take a look and update the repository to fix all issues reported by GitHub dependabot? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix GitHub dependabot alerts.