V3.9#44
Merged
Merged
Conversation
Clears both high-severity wrangler alerts (OS command injection in
`wrangler pages deploy`, GHSA range >=4.0.0 <4.59.1). wrangler is a
direct dep in packages/console/{app,support}, both pinned 4.50.0 —
bumped to 4.59.1, a same-major patch with no breaking changes.
Scope note: two transitive wrangler copies remain in the lockfile
(4.14.1 via @astrojs/cloudflare, 4.50.0 via @cloudflare/vite-plugin).
Dependabot does not flag those (only the console direct declarations
were alerted); they clear when @astrojs/cloudflare goes to 13 in the
astro-6 wave. Isolated to console — no overlap with V3.9
(core/deepagent-code/app).
Verified: top-level wrangler resolves to 4.59.1 and runs; lockfile
regenerated. No source changes.
### Issue for this PR
Closes #
### Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor / code improvement
- [ ] Documentation
### What does this PR do?
Please provide a description of the issue, the changes you made to fix
it, and why they work. It is expected that you understand why your
changes work and if you do not understand why at least say as much so a
maintainer knows how much to value the PR.
**If you paste a large clearly AI generated description here your PR may
be IGNORED or CLOSED!**
### How did you verify your code works?
### Screenshots / recordings
_If this is a UI change, please include a screenshot or recording._
### Checklist
- [ ] I have tested my changes locally
- [ ] I have not included unrelated changes in this PR
_If you do not follow this template your PR will be automatically
rejected._
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
### Issue for this PR Closes # ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor / code improvement - [ ] Documentation ### What does this PR do? Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR. **If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!** ### How did you verify your code works? ### Screenshots / recordings _If this is a UI change, please include a screenshot or recording._ ### Checklist - [ ] I have tested my changes locally - [ ] I have not included unrelated changes in this PR _If you do not follow this template your PR will be automatically rejected._ --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Clears both high-severity minimatch alerts on packages/deepagent-code (GHSA ranges >=10.0.0 <10.2.1 and <10.2.3). Same-major patch, no breaking changes. packages/core was already on 10.2.5 (unaffected). Verified: deepagent-code resolves minimatch 10.2.3; glob match/nomatch behavior intact; 10.0.3 gone from bun.lock. No source changes. ### Issue for this PR Closes # ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor / code improvement - [ ] Documentation ### What does this PR do? Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR. **If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!** ### How did you verify your code works? ### Screenshots / recordings _If this is a UI change, please include a screenshot or recording._ ### Checklist - [ ] I have tested my changes locally - [ ] I have not included unrelated changes in this PR _If you do not follow this template your PR will be automatically rejected._ Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
#40) … adapter Clears all 17 remaining web alerts (16 astro medium/high + 1 @astrojs/cloudflare low). The astro high advisories are only patched in 6.x, so a major bump was required; the third-party docs theme blocked it and Cloudflare's adapter broke under astro 6's prerender pipeline. - astro 5.7.13 → 6.4.8; coordinated @astrojs bumps: solid-js 6.0.1, markdown-remark 6.3.11, starlight 0.40.0, check 0.9.9 - remove toolbeam-docs-theme (pinned to astro ^5, no astro-6 release, and it dragged astro 5 back into the lockfile): drop its Starlight plugin and switch the Header override to Starlight's built-in @astrojs/starlight/components/Header - replace @astrojs/cloudflare with @astrojs/node 10.1.4 (standalone) — we deploy locally/self-hosted, not to Cloudflare. The whole web app (docs + the SSR /s/[id] share route) runs under one Node server - image.service = noop to preserve the adapter's prior passthrough behavior (avoids a new Sharp native dep) Verified: `astro build` completes — 631 pages prerendered, search index + sitemap generated, standalone Node server built. astro resolves to a single 6.4.8; no @astrojs/cloudflare or toolbeam left in bun.lock. Follow-up (not in this dep-cleanup wave): infra/app.ts still deploys web via sst.cloudflare.x.Astro; that deployment wiring needs a separate pass to match the Node adapter. ### Issue for this PR Closes # ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor / code improvement - [ ] Documentation ### What does this PR do? Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR. **If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!** ### How did you verify your code works? ### Screenshots / recordings _If this is a UI change, please include a screenshot or recording._ ### Checklist - [ ] I have tested my changes locally - [ ] I have not included unrelated changes in this PR _If you do not follow this template your PR will be automatically rejected._ Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
#41) …, monitoring) Removes upstream (opencode-fork) commercial/operational infrastructure that DeepAgent Code's core (desktop/core/agent/session/LLM) does not depend on and we do not run: - packages/console — Stripe-based subscription/billing SaaS portal (Console/AuthApi/Stat/LogProcessor workers, KV/R2 storage) - packages/stats — public usage-stats dashboard - infra/lake.ts — AWS S3 Tables + Glue data lake (feeds stats analytics) - infra/monitoring.ts — Honeycomb alerts + Discord webhook (ops monitoring) - infra/secret.ts — only consumed by the deleted console/monitoring infra sst.config.ts: drop the console/stats/lake/monitoring imports and their return values; prune the now-unused stripe/planetscale/honeycomb providers (only the deleted infra used them). Nothing external depended on these packages (no @deepagent-code/console|stats importers), and app.ts (the surviving api worker + web/app deploy) only needs `domain` from stage.ts. We will re-fork/implement console + stats fresh when we actually need them. Verified: 9 workspace packages pruned from bun.lock; core typechecks clean; no dangling references to any deleted file/provider/package remain. ### Issue for this PR Closes # ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor / code improvement - [ ] Documentation ### What does this PR do? Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR. **If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!** ### How did you verify your code works? ### Screenshots / recordings _If this is a UI change, please include a screenshot or recording._ ### Checklist - [ ] I have tested my changes locally - [ ] I have not included unrelated changes in this PR _If you do not follow this template your PR will be automatically rejected._ Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
### Issue for this PR Closes # ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor / code improvement - [ ] Documentation ### What does this PR do? Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR. **If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!** ### How did you verify your code works? ### Screenshots / recordings _If this is a UI change, please include a screenshot or recording._ ### Checklist - [ ] I have tested my changes locally - [ ] I have not included unrelated changes in this PR _If you do not follow this template your PR will be automatically rejected._ Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
### Issue for this PR Closes # ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor / code improvement - [ ] Documentation ### What does this PR do? Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR. **If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!** ### How did you verify your code works? ### Screenshots / recordings _If this is a UI change, please include a screenshot or recording._ ### Checklist - [ ] I have tested my changes locally - [ ] I have not included unrelated changes in this PR _If you do not follow this template your PR will be automatically rejected._ --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue for this PR
Closes #
Type of change
What does this PR do?
Please provide a description of the issue, the changes you made to fix it, and why they work. It is expected that you understand why your changes work and if you do not understand why at least say as much so a maintainer knows how much to value the PR.
If you paste a large clearly AI generated description here your PR may be IGNORED or CLOSED!
How did you verify your code works?
Screenshots / recordings
If this is a UI change, please include a screenshot or recording.
Checklist
If you do not follow this template your PR will be automatically rejected.