From bc9bcabd0633f40596dd3907b1f14e4ff393e3a3 Mon Sep 17 00:00:00 2001 From: Will Washburn Date: Wed, 10 Jun 2026 11:05:33 -0400 Subject: [PATCH 1/2] fix(deps): patch vulnerable transitive deps (shell-quote, protobufjs, hono) and align adapter-core Co-Authored-By: Claude Fable 5 --- package.json | 17 +++ packages/daytona-runner/package.json | 4 +- packages/deploy/package.json | 2 +- packages/runtime/package.json | 2 +- pnpm-lock.yaml | 165 ++++++++++++--------------- 5 files changed, 96 insertions(+), 94 deletions(-) diff --git a/package.json b/package.json index 7d087d61..ba0607d4 100644 --- a/package.json +++ b/package.json @@ -4,6 +4,23 @@ "private": true, "version": "0.1.0", "packageManager": "pnpm@10.17.1", + "pnpm": { + "overrides": { + "shell-quote": ">=1.8.4", + "@opentelemetry/otlp-transformer>protobufjs": ">=8.2.0", + "@grpc/proto-loader>protobufjs": ">=7.5.8 <8.0.0", + "hono": ">=4.12.21", + "ws": ">=8.20.1", + "qs": ">=6.15.2" + }, + "packageExtensions": { + "@daytonaio/sdk@*": { + "dependencies": { + "ws": ">=8.20.1" + } + } + } + }, "devDependencies": { "@types/node": "^22.18.0", "agent-trajectories": "^0.5.3", diff --git a/packages/daytona-runner/package.json b/packages/daytona-runner/package.json index e8f2e5d9..d893187e 100644 --- a/packages/daytona-runner/package.json +++ b/packages/daytona-runner/package.json @@ -34,9 +34,9 @@ }, "dependencies": {}, "peerDependencies": { - "@daytonaio/sdk": "^0.179.0" + "@daytonaio/sdk": "^0.185.0" }, "devDependencies": { - "@daytonaio/sdk": "^0.179.0" + "@daytonaio/sdk": "^0.185.0" } } diff --git a/packages/deploy/package.json b/packages/deploy/package.json index cecdda4e..13b85abb 100644 --- a/packages/deploy/package.json +++ b/packages/deploy/package.json @@ -35,7 +35,7 @@ "@agent-relay/cloud": "^6.0.17", "@agentworkforce/persona-kit": "workspace:*", "@agentworkforce/runtime": "workspace:*", - "@daytonaio/sdk": "^0.179.0", + "@daytonaio/sdk": "^0.185.0", "esbuild": "^0.25.0" } } diff --git a/packages/runtime/package.json b/packages/runtime/package.json index a603a24d..b978eec0 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -56,7 +56,7 @@ "@agent-assistant/proactive": "^0.4.32", "@agent-relay/events": "^6.3.3", "@agentworkforce/persona-kit": "workspace:*", - "@relayfile/adapter-core": "^0.3.29", + "@relayfile/adapter-core": "^0.3.31", "agent-trajectories": "^0.5.3" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b8165b90..e04d16cb 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,16 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + shell-quote: '>=1.8.4' + '@opentelemetry/otlp-transformer>protobufjs': '>=8.2.0' + '@grpc/proto-loader>protobufjs': '>=7.5.8 <8.0.0' + hono: '>=4.12.21' + ws: '>=8.20.1' + qs: '>=6.15.2' + +packageExtensionsChecksum: sha256-xRQ+4K+v0ADX3o2xJ1wOmlyJpgtjKM3uP+Xe4ZRBGAI= + importers: .: @@ -54,8 +64,8 @@ importers: packages/daytona-runner: devDependencies: '@daytonaio/sdk': - specifier: ^0.179.0 - version: 0.179.0(ws@8.20.0) + specifier: ^0.185.0 + version: 0.185.0 packages/deploy: dependencies: @@ -69,8 +79,8 @@ importers: specifier: workspace:* version: link:../runtime '@daytonaio/sdk': - specifier: ^0.179.0 - version: 0.179.0(ws@8.20.0) + specifier: ^0.185.0 + version: 0.185.0 esbuild: specifier: ^0.25.0 version: 0.25.12 @@ -128,8 +138,8 @@ importers: specifier: workspace:* version: link:../persona-kit '@relayfile/adapter-core': - specifier: ^0.3.29 - version: 0.3.29(@relayfile/sdk@0.7.40) + specifier: ^0.3.31 + version: 0.3.31(@relayfile/sdk@0.7.40) agent-trajectories: specifier: ^0.5.3 version: 0.5.3 @@ -357,14 +367,14 @@ packages: bundledDependencies: - is-unicode-supported - '@daytona/api-client@0.179.0': - resolution: {integrity: sha512-5szyt5NyTQv/yPgreuQqIEu79sE7VKAzrYCnpJMByJSnIoViZ6kvgrOJTPC+kJs6RJUO/G3wyM8iMDsvYkL2KA==} + '@daytona/api-client@0.185.0': + resolution: {integrity: sha512-7GkzODTein+yc9ZBPmPsOpwuHoL+t3/ukDkuEKasGGCIT5EoTr4blwCoyCft4C0iSVGx4ha5D68ECmFqbhKGAw==} - '@daytona/toolbox-api-client@0.179.0': - resolution: {integrity: sha512-CgfoVrksH+WRjf4ZPcNZfE6vhEOmqkGN5JRJ6rqbcfWVNLwpl46/s8qw/Zz8H/37i0c1enNl+QokLyW5fCxS3w==} + '@daytona/toolbox-api-client@0.185.0': + resolution: {integrity: sha512-ghUBaGGGiIuJ7MIhhKOlG/nn4cmNY1gB3Fd6s8X1aXEMoV9JgLCuAnkxrCiKYg74A4z7126dS7grILK4GNlzyw==} - '@daytonaio/sdk@0.179.0': - resolution: {integrity: sha512-KZErEaClqW9arLb1xI78R/9T0eOGWSShcruszgwXP6MR53mVAFmmhQ/OOGFXpV+xQ8HYB1HYl0FcK2CTaxHNgA==} + '@daytonaio/sdk@0.185.0': + resolution: {integrity: sha512-yVOzRShA9fmoGSG+wlSq6JrRLmc4h9yUTAjjfGonD6f2NjzwQuu1FadUCYlyVOmasKEn/Du9w27NgmXdMQp6JA==} '@esbuild/aix-ppc64@0.25.12': resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==} @@ -535,7 +545,7 @@ packages: resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==} engines: {node: '>=18.14.1'} peerDependencies: - hono: ^4 + hono: '>=4.12.21' '@iarna/toml@2.2.5': resolution: {integrity: sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==} @@ -889,17 +899,17 @@ packages: '@protobufjs/codegen@2.0.5': resolution: {integrity: sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==} - '@protobufjs/eventemitter@1.1.0': - resolution: {integrity: sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==} + '@protobufjs/eventemitter@1.1.1': + resolution: {integrity: sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==} - '@protobufjs/fetch@1.1.0': - resolution: {integrity: sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==} + '@protobufjs/fetch@1.1.1': + resolution: {integrity: sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==} '@protobufjs/float@1.0.2': resolution: {integrity: sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==} - '@protobufjs/inquire@1.1.1': - resolution: {integrity: sha512-mnzgDV26ueAvk7rsbt9L7bE0SuAoqyuys/sMMrmVcN5x9VsxpcG3rqAUSgDyLp0UZlmNfIbQ4fHfCtreVBk8Ew==} + '@protobufjs/inquire@1.1.2': + resolution: {integrity: sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==} '@protobufjs/path@1.1.2': resolution: {integrity: sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==} @@ -938,13 +948,6 @@ packages: resolution: {integrity: sha512-C5eVSepGrlQY5b1yg+LfROLYhDW/w1WFVsuitRzvbXMr+qpFYFHLoMNxa9R0Q6ZiP02r6EXSazii2VNo2LZ0Vg==} engines: {node: '>=22'} - '@relayfile/adapter-core@0.3.29': - resolution: {integrity: sha512-rOTKgTofH5NUB9Q47GKJHv54dRJNS8rQS1FO0qON4MQpdKJ9RK69uJlQ52YJ/O73AGuj0qfnfZP1xcnA+3X4yw==} - engines: {node: '>=18'} - hasBin: true - peerDependencies: - '@relayfile/sdk': '>=0.6.0 <1' - '@relayfile/adapter-core@0.3.31': resolution: {integrity: sha512-wcZXc4CkX5YqItZl4BLczioO7LZ1DG0F7GeBis1uQ1CYfdqyEm2zSRenz1fPMzEbhy0vldX+ytVOFxybzDzz/Q==} engines: {node: '>=18'} @@ -1561,8 +1564,8 @@ packages: resolution: {integrity: sha512-eSmmWE5bZTK2Nou4g0AI3zZ9rswp7GRKoKXS1BLUkvPviOqs4YTN1djQIqrXy9k5gEtdLPy86JjRwsNM9tnDcA==} engines: {node: '>=0.10.0'} - hono@4.12.18: - resolution: {integrity: sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==} + hono@4.12.25: + resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==} engines: {node: '>=16.9.0'} htmlparser2@10.1.0: @@ -1635,7 +1638,7 @@ packages: isomorphic-ws@5.0.0: resolution: {integrity: sha512-muId7Zzn9ywDsyXgTIafTry2sV3nySZeUDe6YedVd1Hvuuep5AsIlqK+XefWpYTyJG5e503F2xIuT2lcU6rCSw==} peerDependencies: - ws: '*' + ws: '>=8.20.1' jose@6.2.3: resolution: {integrity: sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==} @@ -1818,12 +1821,12 @@ packages: resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==} engines: {node: '>=16.20.0'} - protobufjs@7.5.7: - resolution: {integrity: sha512-NGnrxS/nLKUo5nkbVQxlC71sB4hdfImdYIbFeSCidxtwATx0AHRPcANSLd0q5Bb2BkoSWo2iisQhGg5/r+ihbA==} + protobufjs@7.6.3: + resolution: {integrity: sha512-+k0vdJKNdW+Vu+dYe8tZA/VvQb6XKNWexC6URwBFXxNnjLJz9nQJCemGyNgRAWD+B7+nGNc9qMPGwcD7s4nzUw==} engines: {node: '>=12.0.0'} - protobufjs@8.0.1: - resolution: {integrity: sha512-NWWCCscLjs+cOKF/s/XVNFRW7Yih0fdH+9brffR5NZCy8k42yRdl5KlWKMVXuI1vfCoy4o1z80XR/W/QUb3V3w==} + protobufjs@8.6.2: + resolution: {integrity: sha512-CCERJxzRvKMeEdJSLwdQf40TXWNPc8M4RkN7j/lxY6FQB+4do8rETWqj60AqxP9n0XIsxnSefZ8uhAaGKg2njw==} engines: {node: '>=12.0.0'} proxy-addr@2.0.7: @@ -1834,8 +1837,8 @@ packages: resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==} engines: {node: '>=10'} - qs@6.15.1: - resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==} + qs@6.15.2: + resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==} engines: {node: '>=0.6'} queue-microtask@1.2.3: @@ -1909,8 +1912,8 @@ packages: resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==} engines: {node: '>=8'} - shell-quote@1.8.3: - resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==} + shell-quote@1.8.4: + resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==} engines: {node: '>= 0.4'} side-channel-list@1.0.1: @@ -2048,8 +2051,8 @@ packages: wrappy@1.0.2: resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==} - ws@8.20.0: - resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==} + ws@8.21.0: + resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==} engines: {node: '>=10.0.0'} peerDependencies: bufferutil: ^4.0.1 @@ -2673,24 +2676,24 @@ snapshots: picocolors: 1.1.1 sisteransi: 1.0.5 - '@daytona/api-client@0.179.0': + '@daytona/api-client@0.185.0': dependencies: axios: 1.16.0 transitivePeerDependencies: - debug - '@daytona/toolbox-api-client@0.179.0': + '@daytona/toolbox-api-client@0.185.0': dependencies: axios: 1.16.0 transitivePeerDependencies: - debug - '@daytonaio/sdk@0.179.0(ws@8.20.0)': + '@daytonaio/sdk@0.185.0': dependencies: '@aws-sdk/client-s3': 3.1045.0 '@aws-sdk/lib-storage': 3.1045.0(@aws-sdk/client-s3@3.1045.0) - '@daytona/api-client': 0.179.0 - '@daytona/toolbox-api-client': 0.179.0 + '@daytona/api-client': 0.185.0 + '@daytona/toolbox-api-client': 0.185.0 '@iarna/toml': 2.2.5 '@opentelemetry/api': 1.9.1 '@opentelemetry/exporter-trace-otlp-http': 0.217.0(@opentelemetry/api@1.9.1) @@ -2706,15 +2709,17 @@ snapshots: expand-tilde: 2.0.2 fast-glob: 3.3.3 form-data: 4.0.5 - isomorphic-ws: 5.0.0(ws@8.20.0) + isomorphic-ws: 5.0.0(ws@8.21.0) pathe: 2.0.3 - shell-quote: 1.8.3 + shell-quote: 1.8.4 tar: 7.5.15 + ws: 8.21.0 transitivePeerDependencies: - aws-crt + - bufferutil - debug - supports-color - - ws + - utf-8-validate '@esbuild/aix-ppc64@0.25.12': optional: true @@ -2803,12 +2808,12 @@ snapshots: dependencies: lodash.camelcase: 4.3.0 long: 5.3.2 - protobufjs: 7.5.7 + protobufjs: 7.6.3 yargs: 17.7.2 - '@hono/node-server@1.19.14(hono@4.12.18)': + '@hono/node-server@1.19.14(hono@4.12.25)': dependencies: - hono: 4.12.18 + hono: 4.12.25 '@iarna/toml@2.2.5': {} @@ -2820,7 +2825,7 @@ snapshots: '@modelcontextprotocol/sdk@1.29.0(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.14(hono@4.12.18) + '@hono/node-server': 1.19.14(hono@4.12.25) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -2830,7 +2835,7 @@ snapshots: eventsource-parser: 3.0.8 express: 5.2.1 express-rate-limit: 8.5.1(express@5.2.1) - hono: 4.12.18 + hono: 4.12.25 jose: 6.2.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -3047,7 +3052,7 @@ snapshots: '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.1) - protobufjs: 7.5.7 + protobufjs: 8.6.2 '@opentelemetry/otlp-transformer@0.217.0(@opentelemetry/api@1.9.1)': dependencies: @@ -3058,7 +3063,7 @@ snapshots: '@opentelemetry/sdk-logs': 0.217.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-metrics': 2.7.1(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1) - protobufjs: 8.0.1 + protobufjs: 8.6.2 '@opentelemetry/propagator-b3@2.7.1(@opentelemetry/api@1.9.1)': dependencies: @@ -3229,16 +3234,15 @@ snapshots: '@protobufjs/codegen@2.0.5': {} - '@protobufjs/eventemitter@1.1.0': {} + '@protobufjs/eventemitter@1.1.1': {} - '@protobufjs/fetch@1.1.0': + '@protobufjs/fetch@1.1.1': dependencies: '@protobufjs/aspromise': 1.1.2 - '@protobufjs/inquire': 1.1.1 '@protobufjs/float@1.0.2': {} - '@protobufjs/inquire@1.1.1': {} + '@protobufjs/inquire@1.1.2': {} '@protobufjs/path@1.1.2': {} @@ -3265,14 +3269,6 @@ snapshots: '@relayburn/sdk-linux-arm64-gnu': 2.5.2 '@relayburn/sdk-linux-x64-gnu': 2.5.2 - '@relayfile/adapter-core@0.3.29(@relayfile/sdk@0.7.40)': - dependencies: - '@relayfile/sdk': 0.7.40 - '@scalar/postman-to-openapi': 0.6.3 - cheerio: 1.2.0 - minimatch: 10.2.5 - yaml: 2.9.0 - '@relayfile/adapter-core@0.3.31(@relayfile/sdk@0.7.40)': dependencies: '@relayfile/sdk': 0.7.40 @@ -3589,7 +3585,7 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.7.2 on-finished: 2.4.1 - qs: 6.15.1 + qs: 6.15.2 raw-body: 3.0.2 type-is: 2.0.1 transitivePeerDependencies: @@ -3863,7 +3859,7 @@ snapshots: once: 1.4.0 parseurl: 1.3.3 proxy-addr: 2.0.7 - qs: 6.15.1 + qs: 6.15.2 range-parser: 1.2.1 router: 2.2.0 send: 1.2.1 @@ -3983,7 +3979,7 @@ snapshots: dependencies: parse-passwd: 1.0.0 - hono@4.12.18: {} + hono@4.12.25: {} htmlparser2@10.1.0: dependencies: @@ -4043,9 +4039,9 @@ snapshots: isexe@2.0.0: {} - isomorphic-ws@5.0.0(ws@8.20.0): + isomorphic-ws@5.0.0(ws@8.21.0): dependencies: - ws: 8.20.0 + ws: 8.21.0 jose@6.2.3: {} @@ -4187,34 +4183,23 @@ snapshots: pkce-challenge@5.0.1: {} - protobufjs@7.5.7: + protobufjs@7.6.3: dependencies: '@protobufjs/aspromise': 1.1.2 '@protobufjs/base64': 1.1.2 '@protobufjs/codegen': 2.0.5 - '@protobufjs/eventemitter': 1.1.0 - '@protobufjs/fetch': 1.1.0 + '@protobufjs/eventemitter': 1.1.1 + '@protobufjs/fetch': 1.1.1 '@protobufjs/float': 1.0.2 - '@protobufjs/inquire': 1.1.1 + '@protobufjs/inquire': 1.1.2 '@protobufjs/path': 1.1.2 '@protobufjs/pool': 1.1.0 '@protobufjs/utf8': 1.1.1 '@types/node': 22.19.15 long: 5.3.2 - protobufjs@8.0.1: + protobufjs@8.6.2: dependencies: - '@protobufjs/aspromise': 1.1.2 - '@protobufjs/base64': 1.1.2 - '@protobufjs/codegen': 2.0.5 - '@protobufjs/eventemitter': 1.1.0 - '@protobufjs/fetch': 1.1.0 - '@protobufjs/float': 1.0.2 - '@protobufjs/inquire': 1.1.1 - '@protobufjs/path': 1.1.2 - '@protobufjs/pool': 1.1.0 - '@protobufjs/utf8': 1.1.1 - '@types/node': 22.19.15 long: 5.3.2 proxy-addr@2.0.7: @@ -4224,7 +4209,7 @@ snapshots: proxy-from-env@2.1.0: {} - qs@6.15.1: + qs@6.15.2: dependencies: side-channel: 1.1.0 @@ -4316,7 +4301,7 @@ snapshots: shebang-regex@3.0.0: {} - shell-quote@1.8.3: {} + shell-quote@1.8.4: {} side-channel-list@1.0.1: dependencies: @@ -4461,7 +4446,7 @@ snapshots: wrappy@1.0.2: {} - ws@8.20.0: {} + ws@8.21.0: {} xml-naming@0.1.0: {} From cd226b2bcb9d4c94b164b2a6b0fe747642914b45 Mon Sep 17 00:00:00 2001 From: Will Washburn Date: Wed, 10 Jun 2026 14:48:10 -0400 Subject: [PATCH 2/2] fix(deps): version-qualify protobufjs override so otlp-transformer 0.207.x keeps protobufjs 7.x Co-Authored-By: Claude Fable 5 --- package.json | 3 ++- pnpm-lock.yaml | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index ba0607d4..1f7e37bc 100644 --- a/package.json +++ b/package.json @@ -7,7 +7,8 @@ "pnpm": { "overrides": { "shell-quote": ">=1.8.4", - "@opentelemetry/otlp-transformer>protobufjs": ">=8.2.0", + "@opentelemetry/otlp-transformer@<0.217.0>protobufjs": ">=7.5.8 <8.0.0", + "@opentelemetry/otlp-transformer@>=0.217.0>protobufjs": ">=8.2.0", "@grpc/proto-loader>protobufjs": ">=7.5.8 <8.0.0", "hono": ">=4.12.21", "ws": ">=8.20.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index e04d16cb..2fb6eb20 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,7 +6,8 @@ settings: overrides: shell-quote: '>=1.8.4' - '@opentelemetry/otlp-transformer>protobufjs': '>=8.2.0' + '@opentelemetry/otlp-transformer@<0.217.0>protobufjs': '>=7.5.8 <8.0.0' + '@opentelemetry/otlp-transformer@>=0.217.0>protobufjs': '>=8.2.0' '@grpc/proto-loader>protobufjs': '>=7.5.8 <8.0.0' hono: '>=4.12.21' ws: '>=8.20.1' @@ -3052,7 +3053,7 @@ snapshots: '@opentelemetry/sdk-logs': 0.207.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-metrics': 2.2.0(@opentelemetry/api@1.9.1) '@opentelemetry/sdk-trace-base': 2.2.0(@opentelemetry/api@1.9.1) - protobufjs: 8.6.2 + protobufjs: 7.6.3 '@opentelemetry/otlp-transformer@0.217.0(@opentelemetry/api@1.9.1)': dependencies: