Repository navigation
fix(deps): pin patched follow-redirects, hono, and vite - #392
Merged
Merged
Conversation
Clear the security audit advisories published 2026-10-20 with root pnpm overrides. vite is capped at 8.1.x to avoid a larger build-tool jump. The lockfile is a web build input, so the web bundle is restaged and the Nix dependency hash is refreshed.
|
Important Review skippedToo many files! This PR contains 393 files, which is 293 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters: 3
📒 Files selected for processing: 393
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
commit: |
A minimum of 8.1.6 keeps the advisory fix and lets normal upgrades move past 8.1. The lockfile still resolves 8.1.6.
5 of 6 tasks
The parser joined every incoming chunk onto the whole buffer, so a 65 MB request copied tens of gigabytes and the oversized-request test timed out on slower CI runners. Chunks now wait in a list until the pending bulk string can complete, then join once.
This reverts commit 5c2d592.
5 of 6 tasks
elkaix
added a commit
that referenced
this pull request
Oct 20, 2026
## Requirement or Bug `test-minidb` times out on slower CI runners in `RESP: an oversized request gets -ERR and the connection recovers` (20 s, 0 bytes back). It failed twice on #392, which does not touch minidb. ## Bug Reproduction Steps 1. Start the minidb RESP server. 2. Send one `SET` whose bulk value is 65 MB (over the 64 MB request cap), then `PING`. 3. The `-ERR ... too large` reply takes about 2.4 s on an M5 Max and more than 20 s on a loaded CI runner. ## Root Cause `RespParser.feed` joined each incoming socket chunk onto the whole buffered request (`Buffer.concat([this.buf, chunk])`). A 65 MB request arrives in about a thousand chunks, so the parser copied tens of gigabytes before it reached the cap. This is a fix at the root, not a timeout increase. ## Code Changes ```diff RespParser.feed(chunk) - buf = concat(buf, chunk) every chunk + pending.push(chunk); size += chunk.length + size < need -> return bulk string still incomplete + buf = concat(buf, ...pending) once RespParser.tryParse() + bulk string incomplete -> need = bytes required ``` The oversized-request check and its buffer reset do not change; they now count `size`, which includes the pending chunks. ## Behavior Changes and Affected Users | Behavior | Before | After | Who relies on the old behavior | Escape hatch | |---|---|---|---|---| | RESP request larger than one chunk | Buffer copied on every chunk | Chunks joined once the bulk string can complete | Nobody | n/a | Tests: oversized-request test 2381 ms before, 48 ms after (local). New test `RESP: a bulk value split across many small writes is reassembled` covers the split path. minidb suite 554 passed; `tsc` clean; `pnpm run lint` 0 errors. [skip changeset] Users cannot see this change: it only changes how fast the RESP server buffers large requests. ## Checklist - [x] I have read the [CONTRIBUTING](https://github.com/PyModel/pythinker-code/blob/main/CONTRIBUTING.md) document. - [ ] I have linked a related issue (external PRs: issue must have a maintainer's `/approve`). - [x] I have added tests that prove my feature works. - [x] The behavior-change table above is complete, and every removed behavior or flipped default is named in the changeset and either has an escape hatch or was explicitly approved by a maintainer in this PR. - [x] Ran `gen-changesets` skill, or this PR needs no changeset. - [x] Ran `gen-docs` skill, or this PR needs no doc update.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requirement or Bug
pnpm audit(the required Security audit check) fails onmainand on every open PR because of advisories published 2026-10-20 against follow-redirects (GHSA-q3jh-wrc6-jgq8, GHSA-8r9p-f939-6h3c), hono (GHSA-5r4p-p66f-jhc7) and vite (GHSA-698v-4r3x-3vcv).Bug Reproduction Steps
main.pnpm audit. It reports the four advisories and exits non-zero.Root Cause
The lockfile resolves follow-redirects 1.16.0, hono 4.13.8 and vite 8.0.16, which are inside the affected ranges.
Code Changes
pnpm-lock.yamlregenerated with pnpm: follow-redirects 1.16.1, hono 4.13.13, vite 8.1.6.apps/pythinker-code/dist-webis restaged withpnpm run build:web.flake.nixpnpmDeps hash refreshed.No new dependencies: the three packages were already in the tree.
Behavior Changes and Affected Users
Local checks:
pnpm auditexits 0,check-web-assetsOK,nix build .#pythinker-codepasses. [skip changeset] Users cannot see this change: it moves build and dev tooling to patch releases.Checklist
/approve).gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.