Repository navigation
fix: clear the high-severity UI and Echo advisories - #375
Merged
Merged
Conversation
bun audit reported two high advisories, which failed `just check` and blocked every push. Upgrade happy-dom to 21.0.4 (GHSA-834v-8h66-3h79 affects up to 21.0.3) and zod 4 to 4.6.6 (GHSA-mrhx-c7xc-m3w5), and rebuild the embedded UI and THIRD_PARTY_NOTICES for the new zod. The zod advisory remains in the zod 3 copy that @ag-ui/client and @ag-ui/proto require, and zod 3 has no patched release. In the browser it parses events from Fanout's own authenticated /api/agent/runs, so the worst case is the user's own tab running out of memory. ui-audit ignores it with that rationale until AG-UI moves to zod 4.6.6 or later.
3 tasks done
The runtime image scan fails on Echo v5.4.0: GHSA-cxf3-9h37-7rr8 (critical, rejected WebSocket upgrades can bypass Echo) and GHSA-9969-6676-49h5 (high, the WebSocket proxy can retain connections). Both are fixed in v5.4.1; take the latest patch release, v5.4.2, and regenerate THIRD_PARTY_NOTICES.
vishr
changed the title
This was referenced Oct 25, 2026
vishr
added a commit
that referenced
this pull request
Oct 26, 2026
Take the SQLite driver update from #373 (with modernc.org/libc v1.79.0) and regenerate THIRD_PARTY_NOTICES. Echo is already on v5.4.2 from #375. The duckdb-go v2.20000.0 update in #373 is left out: it moves the native bindings to go.duckdb.org/libduckdb and references duckdb_register_static_extensions, which the pinned DuckDB v2.0.0 static archive does not export, so every DuckDB build fails to link.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
bun auditreported two high advisories inui/host, which failedjust checkand the pre-push hook onmain.internal/ui/dist,internal/mcp/apps) andTHIRD_PARTY_NOTICESare rebuilt for it.@ag-ui/clientand@ag-ui/protorequire (^3.25.76, also in AG-UI 1.0.3), and zod 3 has no patched release. In the browser it parses events from Fanout's own authenticated/api/agent/runs, so the worst case is the user's own tab running out of memory.ui-auditignores the advisory with that rationale in the Justfile, to be dropped when AG-UI moves to zod 4.6.6 or later.Verification
just check: all checks passed, includingui-audit("No vulnerabilities found", one ignored),ui-check,notices-check, Go and UI tests, and the site build.just test-race— not run; no Go code changed.Supersedes #351.