Repository navigation
fix(dependencies): Update Autter-dev/autter-cli - #72
Merged
Merged
Conversation
![autter[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Automated vendor API adaptation for vendor change rup_012ae24ee8e5_2026-10-14. Updated 10 packages to address CVEs: npm packages (brace-expansion, fast-uri, form-data, js-yaml, linkify-it, serialize-javascript, tmp, undici) and Rust packages (gix-fs, gix-validate). Note: toml crate was not updated as current version 0.9.8 differs from CVE reference (4.1.x).
Automated vendor API adaptation for vendor change rup_e7a662b31946_2026-10-18. Updated zip from 8.6.0 to 9.0.5 (CVE fix for RUSTSEC-2026-0369, RUSTSEC-2026-0367). Updated gix-sec from 0.13.1 to 0.13.3 (CVE fix for GHSA-7rhf-42qf-vrvc). Note: gix-fs could not be upgraded from 0.19.1 to 0.21.1 due to gix-index 0.48.0 requiring gix-fs ^0.19.1. Autter-Fix-Job: rup_e7a662b31946_2026-10-18
Automated vendor API adaptation for vendor change rup_b80d1d27626b_2026-10-20. Updated CVE packages: gix-config 0.53.0->0.62.0 (pulls gix-fs 0.24.0, gix-validate 0.13.0, gix-sec 0.16.0), gix-index 0.48.0->0.57.0, markdown-it 14.2.0->15.0.1, qs 6.15.2->6.16.0. Note: gix updates cause API incompatibilities (non-exhaustive enum patterns in gix-hash). Manual code adjustments may be needed for gix API usage. Packages already at fixed versions: zip 9.0.5, js-yaml 3.15.0, linkify-it 5.0.2, serialize-javascript 7.0.3, tmp 0.2.6, fast-uri 2.4.3, form-data 2.5.6, brace-expansion 1.1.18, undici 6.27.0. Autter-Fix-Job: rup_b80d1d27626b_2026-10-20
Automated vendor API adaptation for vendor change rup_012ae24ee8e5_2026-10-21. Bumped two vulnerable npm dependencies in agent-support/vscode/package-lock.json (the only manifest/lockfile where they appear; both are transitive dev dependencies of the VS Code extension's toolchain). follow-redirects 1.16.0 -> 1.16.1 fixes GHSA-8r9p-f939-6h3c and GHSA-q3jh-wrc6-jgq8. markdown-it 15.0.1 -> 15.0.3 fixes GHSA-gfr2-rv44-r23c and GHSA-r7fv-28h4-cvq7 (the repo pulls markdown-it via @vscode/vsce's ^15.0.0 range, so 15.0.3 was used instead of the 14.x-line fix 14.3.3; 15.0.3 satisfies both advisories). No source call sites exist for either package, so this is a lockfile-only change (1 file, 6 insertions/6 deletions). Verified: JSON-valid lockfile, resolved versions satisfy parent semver ranges (ovsx ^1.16.0, @vscode/vsce ^15.0.0), OSV API confirms pre-change versions are vulnerable and post-change versions have no known vulnerabilities; npm audit reports 0 vulnerabilities. Autter-Fix-Job: rup_012ae24ee8e5_2026-10-21
Revert the zip and gix crate bumps that break cargo check (gix-hash 0.28 needs a sha1/sha256 feature); the CVE fix only needs follow-redirects 1.16.1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sagnik11
marked this pull request as ready for review
October 26, 2026 11:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft adaptation for a third-party vendor API change detected by Autter.
Vendor change
dependencies(production)CVEs added in this project
1.16.11.16.1Why this repo is hit
Scheduled repository update for vendor API changes and known CVEs.
What this PR changes
Bumped follow-redirects from 1.16.0 to 1.16.1 in agent-support/vscode/package-lock.json (version, resolved tarball URL, and integrity hash) to address GHSA-8r9p-f939-6h3c and GHSA-q3jh-wrc6-jgq8. follow-redirects is a transitive dev dependency of ovsx@0.10.12 (spec ^1.16.0, still satisfied by 1.16.1). No package.json changes required since it is not a direct dependency. No other lockfiles (agent-support/opencode, npm/) reference follow-redirects. Verified the new sha512 integrity hash matches the actual npm tarball for follow-redirects@1.16.1.
Remediation safety and rollback
Actual changed files:
agent-support/vscode/package-lock.jsoncode fix: Apply every listed update in one change on branch autter/fix-updates. Do not open a separate pull request. Do not add packages that are not already dependencies. You may edit the lockfile only for: follow-redirects.
Blast radius (unknown): The available analysis has not established the impact on shared callers, users, or data. Prepare the draft automatically; a human must assess these before merge or production rollout.
The actual draft also changes 1 file(s) outside the assessed scope: agent-support/vscode/package-lock.json. Their downstream impact is unknown and requires human rollout review.
Affected: agent-support/vscode/package-lock.json, dependencies
Rollback strategy: Before merge, close the draft PR and discard its branch. If deployed later, revert the fix commit through a reviewed PR and redeploy the previous compatible release. Confirm data/schema compatibility before reverting and verify recovery using the original failure signal.
If this draft is abandoned, close the PR. If deployed later, revert the complete patch, including the additional files, through a reviewed PR; check data/schema compatibility and verify the original failure signal recovers.
Validation required:
Temporary regression tests
Test attempt: passed. Cleanup reported: removed. These results do not block PR creation.
Scenarios:
Commands run:
node agent-support/vscode/.tmp-follow-redirects-test.js,curl -sL -o fr-1.16.1.tgz https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz && python3 -c "...compare base64 integrity to sha512 of tarball...",npm ci (in a temp copy) - attempted; fails on pre-existing out-of-sync packages unrelated to this bumpTemporary test files reported: None reported.
Includes a test guarding the optimized behaviour.
Opened as a draft by Autter. Deprecated packages, breaking API changes, newer API versions, and CVE bumps for this repository land together on
autter/fix-updates. The next day adds a commit to this pull request. Review carefully before merging.Need help on this PR? Tag
@codesmith-botwith what you need.