build(deps): patch vulnerable tooling and refresh dependencies (#138)

build(deps): patch vulnerable tooling and refresh dependencies

Merged after green exact-head CI and autoreview (round 8).

Author: steipete

.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
 

.github/workflows/deploy.yml

@@ -69,7 +69,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
 
@@ -95,7 +95,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
 

.github/workflows/npm-release.yml

@@ -32,7 +32,7 @@ jobs:
           run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -56,7 +56,7 @@ jobs:
         run: pnpm sdk:release:prepare
 
       - name: Retain preflight artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: krillswitch-sdk-${{ github.ref_name }}
           path: |
@@ -82,7 +82,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org
@@ -91,7 +91,7 @@ jobs:
         run: git fetch --no-tags origin main
 
       - name: Download preflight artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: krillswitch-sdk-${{ github.ref_name }}
           path: release-artifacts

.github/workflows/pages.yml

@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: 24.x
 

CHANGELOG.md

@@ -21,12 +21,15 @@ All notable changes to Krillswitch are documented in this file.
 
 ### Changed
 
+- Refresh Hono, Radix, Vite, Cloudflare tooling, and GitHub Actions within compatible versions while preserving the Node.js floor and two-day dependency cooldown.
+
 - Use one shared autoreview installation from `openclaw/agent-skills`; repository entrypoints receive upstream fixes without copied helpers or tests.
 - Refresh compatible application and development dependencies and CodeQL pins, keeping the Better Auth schema generator aligned with its runtime and preserving the Node.js floor and two-day dependency cooldown.
 - Refresh workspace dependencies and GitHub Actions pins, including pnpm 11.24, Carapace 0.6.2, and Cloudflare's renamed Vitest plugin while retaining the two-day dependency release cooldown.
 
 ### Security
 
+- Require Sharp 0.35.5 and source-map-js 1.2.2 to address GHSA-wq5f-xc86-pv6w and GHSA-68fv-2mgg-jv7q while preserving the dependency cooldown.
 - Update Sharp to 0.35.4 and require the patched version in dependency overrides to address libheif advisory GHSA-rgj7-g3m4-5g8c.
 - Require patched Undici 7.29.1 and 8.10.2 in tooling dependencies so exact transitive pins cannot block security updates; retain the two-day release cooldown.
 

apps/admin/package.json

@@ -12,8 +12,8 @@
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/manrope": "^5.3.0",
     "@openclaw/carapace": "github:openclaw/carapace#v0.6.2",
-    "@radix-ui/react-alert-dialog": "^1.1.23",
-    "@radix-ui/react-select": "^2.3.7",
+    "@radix-ui/react-alert-dialog": "^1.1.24",
+    "@radix-ui/react-select": "^2.3.8",
     "@tanstack/react-query": "^5.104.1",
     "clsx": "^2.1.1",
     "react": "^19.3.0",
@@ -25,9 +25,9 @@
     "@tailwindcss/vite": "^4.3.3",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "tailwindcss": "^4.3.3",
     "typescript": "~7.0.2",
-    "vite": "^8.3.2"
+    "vite": "^8.3.3"
   }
 }

apps/api/package.json

@@ -21,16 +21,16 @@
     "@openclaw/krillswitch-core": "workspace:*",
     "better-auth": "1.7.7",
     "drizzle-orm": "^0.45.3",
-    "hono": "4.13.12",
+    "hono": "4.13.13",
     "jose": "^6.2.12",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@cloudflare/vitest-plugin": "^1.3.6",
-    "@cloudflare/workers-types": "^5.20261003.1",
+    "@cloudflare/vitest-plugin": "^1.3.7",
+    "@cloudflare/workers-types": "^5.20261007.1",
     "drizzle-kit": "^0.31.11",
     "typescript": "~7.0.2",
     "vitest": "^4.1.11",
-    "wrangler": "^4.147.0"
+    "wrangler": "^4.148.0"
   }
 }

apps/demo/package.json

@@ -16,8 +16,8 @@
   "devDependencies": {
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
     "typescript": "~7.0.2",
-    "vite": "^8.3.2"
+    "vite": "^8.3.3"
   }
 }