GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — chore/security: update deps for CVEs reported by trivy by burmudar · Pull Request #1319 · sourcegraph/src-cli

Conversation

@burmudar

@burmudar burmudar commented May 8, 2026

Copy link
Copy Markdown
Contributor

Ran trivy:

  • upgrade otel
  • upgrade pgx
  • upgrade tar used by npm-distribution

Test plan

2026-05-08T13:26:57.709+0200    INFO    Vulnerability scanning is enabled
2026-05-08T13:26:57.709+0200    INFO    Secret scanning is enabled
2026-05-08T13:26:57.709+0200    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-05-08T13:26:57.709+0200    INFO    Please see also https://aquasecurity.github.io/trivy/v0.47/docs/scanner/secret/#recommendation for faster secret detection
2026-05-08T13:26:58.119+0200    WARN    Unable to collect additional info: dependency graph error: /Users/william/go/pkg/mod/k8s.io/[email protected]/go.mod parse error: go.mod parse error: go.mod:7: unknown directive: godebug
2026-05-08T13:26:58.130+0200    INFO    Number of language-specific files: 3
2026-05-08T13:26:58.130+0200    INFO    Detecting gomod vulnerabilities...
2026-05-08T13:26:58.132+0200    INFO    Detecting npm vulnerabilities...

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@burmudar
chore/security: update deps for CVEs reported by trivy
5a550e1
@burmudar
burmudar requested review from evict and keegancsmith May 8, 2026 11:29
@burmudar burmudar self-assigned this May 8, 2026
@burmudar
burmudar enabled auto-merge (squash) May 8, 2026 11:53
keegancsmith
keegancsmith approved these changes May 8, 2026
View reviewed changes

@keegancsmith keegancsmith left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

did you run go mod tidy?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@burmudar
burmudar merged commit 720a397 into main May 8, 2026
7 of 8 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@burmudar
burmudar deleted the wb/trivy branch May 8, 2026 12:55
burmudar added a commit that referenced this pull request May 11, 2026
@burmudar
chore/security: update deps for CVEs reported by trivy (#1319)
fbbee9b 
(cherry picked from commit 720a397)
burmudar added a commit that referenced this pull request May 11, 2026
@burmudar
chore/security: update deps for CVEs reported by trivy (#1319)
5d42c74 
(cherry picked from commit 720a397)
@marcleblanc2 marcleblanc2 mentioned this pull request Nov 3, 2026
npm: drop unused dependencies #1397
Merged
marcleblanc2 added a commit that referenced this pull request Nov 4, 2026
@marcleblanc2 @ampagent
npm: drop stale overrides and the unused @types/tar devDependency
94f09e2 
The overrides block was added in #1218 and #1219 to force patched
versions of cross-spawn, glob, and brace-expansion, which tar 7.1
pulled in through rimraf. tar 7.5 (#1319, #1357) dropped rimraf, so
none of those packages are in the dependency tree anymore and the
overrides have no effect. Renovate still reads them as declared
dependencies and keeps opening PRs to bump them (#1389, #1390, #1392,
#1393).

@types/tar is unused: npm-distribution has no TypeScript, and tar 7
ships its own types (#1391 would have replaced it with a deprecated
stub).

Co-authored-by: Amp <[email protected]>
Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8
marcleblanc2 added a commit that referenced this pull request Nov 10, 2026
@marcleblanc2 @ampagent
npm: drop stale overrides and the unused @types/tar devDependency
92846e0 
The overrides block was added in #1218 and #1219 to force patched
versions of cross-spawn, glob, and brace-expansion, which tar 7.1
pulled in through rimraf. tar 7.5 (#1319, #1357) dropped rimraf, so
none of those packages are in the dependency tree anymore and the
overrides have no effect. Renovate still reads them as declared
dependencies and keeps opening PRs to bump them (#1389, #1390, #1392,
#1393).

@types/tar is unused: npm-distribution has no TypeScript, and tar 7
ships its own types (#1391 would have replaced it with a deprecated
stub).

Co-authored-by: Amp <[email protected]>
Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8
marcleblanc2 added a commit that referenced this pull request Nov 10, 2026
@marcleblanc2 @ampagent
npm: drop stale overrides and the unused @types/tar devDependency (#1397
9b493d6 
)

The overrides block was added in #1218 and #1219 to force patched
versions of cross-spawn, glob, and brace-expansion, which tar 7.1
pulled in through rimraf. tar 7.5 (#1319, #1357) dropped rimraf, so
none of those packages are in the dependency tree anymore and the
overrides have no effect. Renovate still reads them as declared
dependencies and keeps opening PRs to bump them (#1389, #1390, #1392,
#1393).

@types/tar is unused: npm-distribution has no TypeScript, and tar 7
ships its own types (#1391 would have replaced it with a deprecated
stub).


Amp-Thread-ID: https://ampcode.com/threads/T-01a1a37e-8603-775d-bc85-c5677817f7a8

Co-authored-by: Amp <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@keegancsmith keegancsmith keegancsmith approved these changes
@evict evict Awaiting requested review from evict

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@burmudar burmudar

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@burmudar @keegancsmith
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.