Skip to content

fix: unblock beta.5 release dependency scan - #329

Merged
Obed0101 merged 1 commit into
devfrom
codex/beta5-security-fixes
Sep 9, 2026
Merged

Obed0101 merged 1 commit into
devfrom
codex/beta5-security-fixes

Conversation

@Obed0101

@Obed0101 Obed0101 commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Summary

  • pin @ai-sdk/provider-utils to 4.0.33 and align @ai-sdk/provider to 3.0.12
  • pin hono to 4.13.5 and js-yaml to 4.3.2
  • update the release lockfile and beta.5 changelog entry

The beta prerelease workflow was blocked by OSV findings for the previous provider-utils, hono, and js-yaml versions. The fixed versions are outside the seven-day release-age window.

Validation

  • bun run --cwd src/mendcode/packages/opencode typecheck
  • Copilot provider tests: 11 passed
  • session prompt tests: 109 passed
  • node --test src/mendcode/script/release-index.test.mjs: 3 passed
  • frozen pnpm install and node-pty repair
  • no vulnerable target versions remain in src/mendcode/pnpm-lock.yaml

@Obed0101
Obed0101 merged commit 4f8e510 into dev Sep 9, 2026
6 checks passed
@Obed0101
Obed0101 deleted the codex/beta5-security-fixes branch September 9, 2026 22:23
@Obed0101 Obed0101 mentioned this pull request Sep 10, 2026
6 of 11 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant