hanzo/extension
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deps: close all 175 dependabot alerts — range-exact overrides, vitest 3, otel 2

Browse Source 
- pnpm overrides pin every vulnerable transitive to its advisory's exact
  first-patched version, scoped to the advisory's own vulnerable range so
  no dependency is dragged across a major it didn't need (criticals:
  form-data 4.0.6, handlebars 4.7.9, protobufjs 7.5.5).
- vitest < 3.2.6 is a critical (CVE fix floor) with no 0.x/1.x backport —
  forced major to ^3.2.6 in every package. Test scripts unify on
  `vitest run` (aci/ai ran bare watch mode). tools' vscode mock alias
  becomes absolute (vitest 3 dropped relative alias resolution).
- packages/ai otel family 1.x → 2.x (core <2.8.0 advisory covers all 1.x):
  resourceFromAttributes, ATTR_* semconv, constructor spanProcessors. The
  previously-uncollectable telemetry suite now runs: ai 31 tests (was 16).
- direct bumps: vite ^6.4.3 (site), esbuild ^0.25.8 (mcp), uuid ^11.1.1
  (tools). packages/ai/package-lock.json deleted — stray npm lockfile in a
  pnpm workspace, carried 24 of the alerts.
- ci: test step filtered @hanzo/tools but the package is @hanzo/cli-tools —
  the suite never ran in CI. Fixed; 87 tests now gate (behind the existing
  continue-on-error). pnpm 9 reads onlyBuiltDependencies from package.json,
  not pnpm-workspace.yaml — mirrored so native build scripts stay allowlisted.

Verified: browser 243/243 + e2e 30/30 + build; aci 29/29; ai 31/31;
cli-tools 87/87; site builds on vite 6; mcp builds on esbuild 0.25.
This commit is contained in:
hanzo-dev
2026-07-03 00:40:07 -07:00
parent fe3c0eabdc
commit 3ab5ae053c
13 changed files with 1711 additions and 6866 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+1 -1
View File
@@ -31,7 +31,7 @@ jobs:
run: pnpm --filter @hanzo/ai test
- name: Test tools package
run: pnpm --filter @hanzo/tools test
run: pnpm --filter @hanzo/cli-tools test
continue-on-error: true
- name: Test VS Code extension
apps/site/package.json
+1 -1
View File
@@ -18,6 +18,6 @@
"devDependencies": {
"@playwright/test": "^1.54.1",
"terser": "^5.43.1",
"vite": "^5.4.19"
"vite": "^6.4.3"
}
}
package.json
+102
View File
@@ -29,5 +29,107 @@
"build:jetbrains": "cd packages/jetbrains && ./gradlew build",
"package:vscode": "pnpm --filter @hanzo/extension run package",
"package:dxt": "pnpm --filter @hanzo/dxt run package"
},
"pnpm": {
"overrides": {
"@babel/core@<=7.29.0": "7.29.6",
"@grpc/grpc-js@<1.9.16": "1.9.16",
"@isaacs/brace-expansion@<=5.0.0": "5.0.1",
"@modelcontextprotocol/sdk@<1.24.0": "1.24.0",
"@modelcontextprotocol/sdk@<1.25.2": "1.25.2",
"@modelcontextprotocol/sdk@>=1.10.0 <=1.25.3": "1.26.0",
"@opentelemetry/core@<2.8.0": "2.8.0",
"@protobufjs/utf8@<=1.1.0": "1.1.1",
"ajv@<6.14.0": "6.14.0",
"ajv@>=7.0.0-alpha.0 <8.18.0": "8.18.0",
"axios@>=1.0.0 <=1.13.4": "1.13.5",
"axios@>=1.0.0 <1.12.0": "1.12.0",
"axios@>=1.0.0 <1.15.0": "1.15.0",
"axios@>=1.0.0 <1.15.1": "1.15.1",
"axios@>=1.0.0 <1.15.2": "1.15.2",
"axios@>=1.0.0 <1.16.0": "1.16.0",
"axios@>=1.7.0 <1.16.0": "1.16.0",
"body-parser@>=2.2.0 <2.2.1": "2.2.1",
"brace-expansion@<1.1.13": "1.1.13",
"brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
"diff@>=6.0.0 <8.0.3": "8.0.3",
"esbuild@<=0.24.2": "0.25.0",
"fast-uri@<=3.1.0": "3.1.1",
"fast-uri@<=3.1.1": "3.1.2",
"file-type@>=13.0.0 <21.3.1": "21.3.1",
"flatted@<=3.4.1": "3.4.2",
"flatted@<3.4.0": "3.4.0",
"follow-redirects@<=1.15.11": "1.16.0",
"form-data@>=4.0.0 <4.0.4": "4.0.4",
"form-data@>=4.0.0 <4.0.6": "4.0.6",
"glob@>=10.2.0 <10.5.0": "10.5.0",
"handlebars@>=4.0.0 <=4.7.8": "4.7.9",
"handlebars@>=4.0.0 <4.7.9": "4.7.9",
"handlebars@>=4.6.0 <=4.7.8": "4.7.9",
"ip-address@<=10.1.0": "10.1.1",
"js-yaml@<3.15.0": "3.15.0",
"js-yaml@>=4.0.0 <=4.1.1": "4.2.0",
"js-yaml@>=4.0.0 <4.1.1": "4.1.1",
"jws@<3.2.3": "3.2.3",
"linkify-it@<=5.0.0": "5.0.1",
"lodash@<=4.17.23": "4.18.0",
"lodash@>=4.0.0 <=4.17.22": "4.17.23",
"lodash@>=4.0.0 <=4.17.23": "4.18.0",
"markdown-it@<=14.1.1": "14.2.0",
"min-document@<=2.19.0": "2.19.1",
"minimatch@<3.1.3": "3.1.3",
"minimatch@<3.1.4": "3.1.4",
"minimatch@>=10.0.0 <10.2.1": "10.2.1",
"minimatch@>=10.0.0 <10.2.3": "10.2.3",
"minimatch@>=5.0.0 <5.1.7": "5.1.7",
"minimatch@>=5.0.0 <5.1.8": "5.1.8",
"minimatch@>=9.0.0 <9.0.6": "9.0.6",
"minimatch@>=9.0.0 <9.0.7": "9.0.7",
"path-to-regexp@>=8.0.0 <8.4.0": "8.4.0",
"picomatch@<2.3.2": "2.3.2",
"picomatch@>=4.0.0 <4.0.4": "4.0.4",
"playwright@<1.55.1": "1.55.1",
"postcss@<8.5.10": "8.5.10",
"protobufjs@<=7.5.5": "7.5.6",
"protobufjs@<=7.5.7": "7.5.8",
"protobufjs@<=7.6.0": "7.6.1",
"protobufjs@<=7.6.2": "7.6.3",
"protobufjs@<7.5.5": "7.5.5",
"qs@<6.14.1": "6.14.1",
"qs@>=6.11.1 <=6.15.1": "6.15.2",
"qs@>=6.7.0 <=6.14.1": "6.14.2",
"rollup@>=4.0.0 <4.59.0": "4.59.0",
"serialize-javascript@<=7.0.2": "7.0.3",
"serialize-javascript@>=5.0.0 <7.0.5": "7.0.5",
"tar-fs@>=2.0.0 <2.1.4": "2.1.4",
"tar-fs@>=3.0.0 <3.1.1": "3.1.1",
"tar@<=7.5.10": "7.5.11",
"tar@<=7.5.15": "7.5.16",
"tar@<=7.5.2": "7.5.3",
"tar@<=7.5.3": "7.5.4",
"tar@<=7.5.9": "7.5.10",
"tar@<7.5.7": "7.5.7",
"tar@<7.5.8": "7.5.8",
"tmp@<=0.2.3": "0.2.4",
"tmp@<0.2.6": "0.2.6",
"underscore@<=1.13.7": "1.13.8",
"undici@>=7.0.0 <7.18.2": "7.18.2",
"undici@>=7.0.0 <7.24.0": "7.24.0",
"undici@>=7.0.0 <7.28.0": "7.28.0",
"uuid@<11.1.1": "11.1.1",
"validator@<13.15.20": "13.15.20",
"validator@<13.15.22": "13.15.22",
"vite@<=5.4.19": "5.4.20",
"vite@<=6.4.1": "6.4.2",
"vite@<=6.4.2": "6.4.3",
"vite@>=5.2.6 <=5.4.20": "5.4.21",
"vitest@<3.2.6": "3.2.6",
"ws@>=8.0.0 <8.20.1": "8.20.1",
"ws@>=8.0.0 <8.21.0": "8.21.0",
"yaml@>=2.0.0 <2.8.3": "2.8.3"
},
"onlyBuiltDependencies": [
"better-sqlite3"
]
}
}
packages/aci/package.json
+3 -3
View File
@@ -7,7 +7,7 @@
"scripts": {
"build": "tsc",
"dev": "tsc --watch",
"test": "vitest",
"test": "vitest run",
"lint": "eslint src --ext .ts",
"prepublishOnly": "npm run build"
},
@@ -32,7 +32,7 @@
"devDependencies": {
"@types/node": "^20.10.5",
"typescript": "^5.3.3",
"vitest": "^1.6.0",
"vitest": "^3.2.6",
"eslint": "^8.56.0",
"@typescript-eslint/eslint-plugin": "^6.19.0",
"@typescript-eslint/parser": "^6.19.0"
@@ -48,4 +48,4 @@
"bugs": {
"url": "https://github.com/hanzoai/aci/issues"
}
}
}
packages/ai/package-lock.json
Generated
-5062
View File
File diff suppressed because it is too large Load Diff
packages/ai/package.json
+10 -10
View File
@@ -33,7 +33,7 @@
"scripts": {
"build": "tsup",
"dev": "tsup --watch",
"test": "vitest",
"test": "vitest run",
"type-check": "tsc --noEmit"
},
"dependencies": {
@@ -41,13 +41,13 @@
"zod": "^3.22.0",
"eventsource-parser": "^1.0.0",
"nanoid": "^5.0.0",
"@opentelemetry/api": "^1.7.0",
"@opentelemetry/resources": "^1.19.0",
"@opentelemetry/semantic-conventions": "^1.19.0",
"@opentelemetry/instrumentation": "^0.46.0",
"@opentelemetry/sdk-trace-node": "^1.19.0",
"@opentelemetry/sdk-trace-base": "^1.19.0",
"@opentelemetry/exporter-trace-otlp-http": "^0.46.0",
"@opentelemetry/api": "^1.9.1",
"@opentelemetry/resources": "^2.9.0",
"@opentelemetry/semantic-conventions": "^1.41.1",
"@opentelemetry/instrumentation": "^0.220.0",
"@opentelemetry/sdk-trace-node": "^2.9.0",
"@opentelemetry/sdk-trace-base": "^2.9.0",
"@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
"winston": "^3.11.0"
},
"peerDependencies": {
@@ -64,7 +64,7 @@
"@types/react": "^18.0.0",
"tsup": "^8.0.0",
"typescript": "^5.3.0",
"vitest": "^1.0.0"
"vitest": "^3.2.6"
},
"keywords": [
"ai",
@@ -80,4 +80,4 @@
"type": "git",
"url": "https://github.com/hanzoai/ai.git"
}
}
}
packages/ai/src/telemetry/hanzo-cloud.ts
+20 -20
View File
@@ -6,8 +6,8 @@
import { Telemetry, TelemetryConfig } from './index';
import * as opentelemetry from '@opentelemetry/api';
import { DiagConsoleLogger, DiagLogLevel, diag } from '@opentelemetry/api';
import { Resource } from '@opentelemetry/resources';
import { SemanticResourceAttributes } from '@opentelemetry/semantic-conventions';
import { resourceFromAttributes } from '@opentelemetry/resources';
import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic-conventions';
import { registerInstrumentations } from '@opentelemetry/instrumentation';
import { NodeTracerProvider } from '@opentelemetry/sdk-trace-node';
import { BatchSpanProcessor } from '@opentelemetry/sdk-trace-base';
@@ -92,14 +92,15 @@ export class HanzoCloudTelemetry extends Telemetry {
}
// Create resource
const resource = new Resource({
[SemanticResourceAttributes.SERVICE_NAME]: config.serviceName || 'hanzo-ai',
[SemanticResourceAttributes.SERVICE_VERSION]: config.serviceVersion || '1.0.0',
[SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT]: config.environment || 'development',
const resource = resourceFromAttributes({
[ATTR_SERVICE_NAME]: config.serviceName || 'hanzo-ai',
[ATTR_SERVICE_VERSION]: config.serviceVersion || '1.0.0',
// stable semconv dropped deployment.environment; keep the raw key
'deployment.environment': config.environment || 'development',
'hanzo.project.id': config.projectId,
'hanzo.cloud.region': process.env.HANZO_CLOUD_REGION || 'us-east-1'
});
// Create OTLP exporter
this.exporter = new OTLPTraceExporter({
url: `${config.cloudUrl}/v1/traces`,
@@ -108,22 +109,21 @@ export class HanzoCloudTelemetry extends Telemetry {
'x-project-id': config.projectId
}
});
// Create provider
// Create provider with batch processor (SDK 2.x: processors are
// constructor-only; addSpanProcessor was removed)
this.provider = new NodeTracerProvider({
resource
resource,
spanProcessors: [
new BatchSpanProcessor(this.exporter, {
maxQueueSize: 1000,
maxExportBatchSize: 512,
scheduledDelayMillis: 5000,
exportTimeoutMillis: 30000
})
]
});
// Add batch processor
this.provider.addSpanProcessor(
new BatchSpanProcessor(this.exporter, {
maxQueueSize: 1000,
maxExportBatchSize: 512,
scheduledDelayMillis: 5000,
exportTimeoutMillis: 30000
})
);
// Register as global provider
this.provider.register();
packages/browser/package.json
+1 -1
View File
@@ -30,7 +30,7 @@
"react": "^18.3.1",
"react-dom": "^18.3.1",
"typescript": "^5.8.3",
"vitest": "^0.34.6",
"vitest": "^3.2.6",
"ws": "^8.18.3"
},
"engines": {
packages/mcp/package.json
+1 -1
View File
@@ -58,7 +58,7 @@
"@types/minimatch": "^5.1.2",
"@types/node": "^20.10.5",
"@types/ws": "^8.18.1",
"esbuild": "^0.19.11",
"esbuild": "^0.25.8",
"jest": "^29.7.0",
"ts-jest": "^29.4.1",
"typescript": "^5.3.3"
packages/tools/package.json
+2 -2
View File
@@ -16,7 +16,7 @@
"js-yaml": "^4.1.0",
"node-fetch": "^3.3.2",
"@modelcontextprotocol/sdk": "^1.15.0",
"uuid": "^10.0.0",
"uuid": "^11.1.1",
"ws": "^8.18.0"
},
"devDependencies": {
@@ -28,7 +28,7 @@
"@types/vscode": "^1.101.0",
"eslint": "^8.57.1",
"typescript": "^5.8.3",
"vitest": "^0.34.6"
"vitest": "^3.2.6"
},
"engines": {
"node": ">=18.0.0"
packages/tools/vitest.config.ts
+3 -1
View File
@@ -1,4 +1,5 @@
import { defineConfig } from 'vitest/config';
import path from 'path';
export default defineConfig({
test: {
@@ -10,7 +11,8 @@ export default defineConfig({
},
resolve: {
alias: {
'vscode': './test/mocks/vscode.ts'
// must be absolute — vitest 3 no longer resolves relative aliases
'vscode': path.resolve(__dirname, 'test/mocks/vscode.ts')
}
}
});
packages/vscode/package.json
+1 -1
View File
@@ -364,7 +364,7 @@
"node-fetch": "^3.3.2",
"sinon": "^21.0.0",
"typescript": "^5.2.2",
"vitest": "^0.34.6"
"vitest": "^3.2.6"
},
"dependencies": {
"@lancedb/lancedb": "^0.21.0",
pnpm-lock.yaml
Generated
+1566 -1763
View File
File diff suppressed because it is too large Load Diff