chore(security): patch CVEs in api/agents/ui + add dependabot config#247
Conversation
Resolves 24 of 27 open Dependabot alerts (1 critical, 12 high, 11 medium). Go modules: - agents/docker-agent: docker v24.0.7 → v25.0.13 (CVE: critical, low, medium); golang.org/x/net v0.19.0 → v0.38.0 (3 medium) - agents/k8s-agent: moby/spdystream v0.5.0 → v0.5.1 (high) - api: go-jose/v4 v4.1.3 → v4.1.4, golang-jwt/v5 v5.2.0 → v5.2.2, goxmldsig v1.4.0 → v1.6.0 (3 high) UI: npm audit fix bumped lockfile-resolved versions for axios, @remix-run/router, flatted, follow-redirects, minimatch, picomatch, postcss, rollup, vite. No package.json changes needed. Adds .github/dependabot.yml so future scans cover the v2 layout (agents/docker-agent, agents/k8s-agent, api, tests, ui, github-actions). Remaining open alerts (3 docker/docker advisories with no upstream patched version) require a docker v25 → v29 major upgrade and are deferred to a separate change.
github-actions
Bot
added
component:backend
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 529b8e478f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| module github.com/streamspace-dev/streamspace/agents/docker-agent | ||
|
|
||
| go 1.21 | ||
| go 1.25.0 |
There was a problem hiding this comment.
Setting go 1.25.0 here raises the module minimum above the docker-agent builder image (agents/docker-agent/Dockerfile uses golang:1.21-alpine), so go mod download/go build in that image will fail with a toolchain-version error before the binary is produced. This makes the documented container build path for docker-agent unusable unless the Dockerfile (and other pinned Go 1.21 environments) are upgraded in the same change.
Useful? React with 👍 / 👎.
1 participant
Summary
.github/dependabot.ymlso weekly scans cover the v2 layout (agents/docker-agent, agents/k8s-agent, api, tests, ui, github-actions)/docker-controllerpath) — those bumps are reapplied here againstagents/docker-agentnpm audit fixin this PRBumps
Go
npm (lockfile-only): axios 1.13.2→1.15.2, @remix-run/router 1.23.1→1.23.2, vite 6.4.1→6.4.2, rollup→4.60.2, minimatch→9.0.9, follow-redirects→1.16.0, picomatch→2.3.2, postcss→8.5.10, flatted→3.4.2.
Verified
go build ./...passes in all 3 modulesnpm run buildpasses (vite production build)npm auditreports 0 vulnerabilities after fixRemaining (deferred)
3 docker/docker GHSA advisories with no upstream patched version (require docker v25 → v29 major upgrade). Tracked separately.
Test plan