chore(deps): upgrade all dependencies by ralyodio · Pull Request #169 · profullstack/tronbrowser.dev

ralyodio · 2026-10-26T13:57:14Z

Fleet dependency upgrade (2026-10-26). This repo does not use Next.js.

Audit (pnpm audit --prod) crit/high: 1/39 -> 0/2. The two highs left are both inside apps/mobile's Expo 57 CLI: zod 3 via @expo/cli, and node-forge 1.4.0, which has no patched release.

Majors taken: eslint 10 + @eslint/js 10 (two preserve-caught-error fixes), typescript 6 (types: ["node"] in tsconfig.base), vitest 5, happy-dom 21, @types/node 26, globals 17, @libsql/client 0.18, @profullstack/stack 0.5, x402-gateway 0.13, profile 0.1.6. Minors: hono 4.13, langchain, deepagents.

Held:

@hono/node-server 2.1.5 -> kept on 1.19.17: @hono/node-ws 1.3.1, the latest release, peers ^1.19.11.
Expo SDK 57 -> 58 in apps/mobile (expo, expo-*, react-native 0.88, react 19.3, react-native-webview 14, @babel/core 8): this is a coordinated SDK move. The EAS job stays workflow_dispatch only.
typescript 7: typescript-eslint peer is <6.1.0.
packageManager stays on pnpm 9 (9.12.0 -> 9.15.9).

Dockerfile: oven/bun 1.4.0-slim -> 1.4.4-slim, pnpm 9.15.9 (node:24 unchanged).

Gate: pnpm -r build, typecheck and lint are clean. All tests pass, including api 111, desktop 163, mobile 174, browser-core 98 and the rest. Booted the API on bun against a throwaway Postgres 17 after running all 8 migrations through @libsql/client 0.18 + libsql-pg: /api/store/extensions 200, /api/auth/me 200, /api/v1/me/profile 401.

🤖 Generated with Claude Code

- eslint 10 (+ preserve-caught-error fixes), typescript 6 (types: node in tsconfig.base), vitest 5, happy-dom 21, @types/node 26, globals 17, @libsql/client 0.18, @profullstack/* latest, hono 4.13, langchain minors - held: @hono/node-server 2 (@hono/node-ws 1.3.1 peers ^1.19), Expo SDK 57 -> 58 (apps/mobile), typescript 7, pnpm 9 (9.15.9) - Dockerfile: oven/bun 1.4.4-slim, pnpm 9.15.9 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-26T13:57:53Z

ThreatCrush Security Scan

50 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 27 | LOW: 21

Severity	Rule	Location
HIGH	`py-ssrf-outbound-request`	`apps/desktop/launcher/tron-tor-helper`:303
HIGH	`py-ssrf-outbound-request`	`apps/desktop/launcher/tron-tor-helper`:437
MEDIUM	`js-open-redirect`	`apps/desktop/extensions/ai-sidebar/install-helper.js`:156
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/media.js`:34
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/media.js`:57
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/newtab.js`:246
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/newtab.js`:275
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/newtab.js`:345
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/options.js`:306
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/sidepanel.js`:78
MEDIUM	`js-unescaped-html-sink`	`apps/desktop/extensions/ai-sidebar/sidepanel.js`:166
MEDIUM	`redos-nested-quantifier`	`apps/desktop/extensions/ai-sidebar/w3bs.js`:17
MEDIUM	`js-unescaped-html-sink`	`apps/extensions/public/store.js`:77
MEDIUM	`js-unescaped-html-sink`	`apps/extensions/public/store.js`:227
MEDIUM	`js-unescaped-html-sink`	`apps/extensions/public/store.js`:571
MEDIUM	`js-unescaped-html-sink`	`apps/web/public/app.js`:29
MEDIUM	`js-unescaped-html-sink`	`apps/web/public/dns.js`:54
MEDIUM	`sh-remote-script-execution`	`apps/web/public/install.sh`:182
MEDIUM	`sh-remote-script-execution`	`apps/web/public/install.sh`:422
MEDIUM	`sh-remote-script-execution`	`apps/web/public/install.sh`:440
MEDIUM	`js-unescaped-html-sink`	`apps/web/public/settings.js`:96
MEDIUM	`js-unescaped-html-sink`	`apps/web/public/settings.js`:168
MEDIUM	`js-dynamic-code-execution`	`packages/sdk/src/mcp/tools.ts`:125
MEDIUM	`js-dynamic-code-execution`	`packages/sdk/src/page.ts`:68
MEDIUM	`js-dynamic-code-execution`	`packages/sdk/src/page.ts`:73
MEDIUM	`js-unescaped-html-sink`	`services/api/src/profile.ts`:59
MEDIUM	`sql-template-interpolation`	`services/api/src/store/db.ts`:116
MEDIUM	`js-dynamic-code-execution`	`services/api/src/store/scanner.ts`:44
MEDIUM	`sh-predictable-temp-path`	`start.sh`:28
LOW	`js-dynamic-code-execution`	`apps/desktop/extensions/ai-sidebar/pit-proxy.test.js`:8
LOW	`js-dynamic-code-execution`	`packages/agent-runtime/src/analyze/form-script.test.ts`:6
LOW	`js-unescaped-html-sink`	`packages/agent-runtime/src/analyze/form-script.test.ts`:26
LOW	`js-unescaped-html-sink`	`packages/agent-runtime/src/analyze/form-script.test.ts`:49
LOW	`js-dynamic-code-execution`	`packages/browser-core/src/automation/extract-script.test.ts`:6
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/extract-script.test.ts`:16
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/extract-script.test.ts`:45
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/extract-script.test.ts`:57
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/extract-script.test.ts`:80
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/extract-script.test.ts`:99
LOW	`js-dynamic-code-execution`	`packages/browser-core/src/automation/snapshot-script.test.ts`:11
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/snapshot-script.test.ts`:62
LOW	`js-unescaped-html-sink`	`packages/browser-core/src/automation/snapshot-script.test.ts`:101
LOW	`js-unescaped-html-sink`	`packages/provenance/src/scan.test.ts`:47
LOW	`js-unescaped-html-sink`	`packages/provenance/src/scan.test.ts`:170
LOW	`js-unescaped-html-sink`	`packages/provenance/src/scan.test.ts`:216
LOW	`js-dynamic-code-execution`	`packages/sdk/src/mcp/automate.test.ts`:261
LOW	`secret-generic-api-key`	`packages/storage/src/config.ts`:51
LOW	`secret-generic-credential`	`packages/storage/src/config.ts`:51
LOW	`js-dynamic-code-execution`	`services/api/src/store/scanner.test.ts`:32
LOW	`js-hardcoded-crypto-key`	`services/api/src/store/signing.test.ts`:24

Snippets are redacted; ThreatCrush never prints matched credential material.

socket-security · 2026-10-26T13:57:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
happy-dom@20.10.6 ⏵ 21.0.4		⁺¹⁶	⁺¹	⁺¹	^-30
@types/react-test-renderer@19.1.0 ⏵ 19.3.0				^-2
typescript-eslint@8.62.0 ⏵ 8.72.0			⁺¹
@profullstack/notifications@0.1.3 ⏵ 0.1.4	⁺¹		⁺³
@profullstack/profile@0.1.3 ⏵ 0.1.6	⁺¹		⁺¹
@profullstack/libsql-pg@0.1.1 ⏵ 0.1.4			⁺¹	⁺⁴
@types/react@19.2.17 ⏵ 19.2.18	⁺¹		⁺¹
vitest@5.0.5
expo-constants@57.0.8 ⏵ 57.0.22	⁺²⁵
@profullstack/stack@0.1.3 ⏵ 0.5.0	⁺⁸		⁺¹	⁺⁷
@types/node@24.13.2 ⏵ 26.6.5	⁺¹		⁺¹
vite@8.3.5
globals@15.15.0 ⏵ 17.13.0			⁺¹
@libsql/client@0.14.0 ⏵ 0.18.0	⁺¹		⁺¹⁴	^-3
@eslint/js@9.39.4 ⏵ 10.0.1
@profullstack/x402-gateway@0.11.0 ⏵ 0.13.1			⁺¹	⁺¹
typescript@6.0.3
@langchain/langgraph@1.4.6 ⏵ 1.5.2	⁺¹		⁺¹
@hono/node-server@1.19.14 ⏵ 1.19.17		⁺²
eslint@9.39.4 ⏵ 10.13.0	⁺¹			⁺⁴⁵
hono@4.12.27 ⏵ 4.13.14	⁺¹	⁺²⁶
deepagents@1.10.5 ⏵ 1.15.1	⁺¹⁸
babel-preset-expo@57.0.5 ⏵ 57.0.16	⁺²³			⁺¹
@langchain/anthropic@1.5.1 ⏵ 1.6.0	⁺¹			⁺¹
@langchain/openai@1.5.3 ⏵ 1.7.0
expo@57.0.9 ⏵ 57.0.31	⁺²⁸		⁺¹	⁺¹

View full report

socket-security · 2026-10-26T13:57:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Publisher changed: npm `bser` is now published by fb-watchman Author: fb-watchman From: pnpm-lock.yaml → `npm/react-native@0.86.2` → `npm/expo@57.0.31` → `npm/bser@2.1.2` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/bser@2.1.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Publisher changed: npm `fb-watchman` is now published by fb-watchman Author: fb-watchman From: pnpm-lock.yaml → `npm/react-native@0.86.2` → `npm/expo@57.0.31` → `npm/fb-watchman@2.0.4` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/fb-watchman@2.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@profullstack/stack` Location: Package overview From: packages/auth/package.json → `npm/@profullstack/stack@0.5.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@profullstack/stack@0.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `rollup` under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.md) From: pnpm-lock.yaml → `npm/vitest@2.1.9` → `npm/rollup@4.65.1` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@4.65.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `typescript` License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: apps/desktop/package.json → `npm/typescript@6.0.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(lint): eslint 10 preserve-caught-error / no-useless-assignment

32b36ed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ralyodio merged commit 16718b4 into main Oct 26, 2026
16 of 17 checks passed

ralyodio deleted the chore/deps-2026-10-26 branch October 26, 2026 14:22

Navigation Menu

Repository navigation

chore(deps): upgrade all dependencies - #169

chore(deps): upgrade all dependencies#169
ralyodio merged 2 commits into
mainfrom
chore/deps-2026-10-26

ralyodio commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

socket-security Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ralyodio commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

ThreatCrush Security Scan

Uh oh!

socket-security Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Oct 26, 2026 •

edited

Loading

socket-security Bot commented Oct 26, 2026 •

edited

Loading