Repository navigation
build(deps): apply Dependabot updates and fix the remaining security alerts - #516
Merged
Merged
Conversation
…ase-please-action to v5 From #512. All three only move the action runtime to Node 24.
… makes unnecessary
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
@xenova/transformers 2.x is deprecated and pulls protobufjs 6 (critical advisory), sharp 0.32 and an old onnxruntime-web. @huggingface/transformers 4.3.1 brings protobufjs 7.6.6, sharp 0.35.5 and onnxruntime-node 1.30. The local provider loads the same model with dtype q8 (onnx/model_quantized.onnx, the 2.x default), so vectors stay compatible with existing indexes. The model is now cached in ~/.libscope/models. The library default is a folder inside its own package; version 4 fails the model load when it cannot write there (global installs, the non-root user of the Docker image). sharp and onnxruntime-node ship prebuilt binaries, so CI and the Docker image rebuild only better-sqlite3.
epub2 pulls adm-zip 0.5 (high advisories). The EPUB parser now reads META-INF/container.xml, the OPF package and its spine with pizzip, which the PPTX parser already uses, and extracts chapter text with a linear tag scanner. The output format is unchanged: body text of each spine document in reading order, chapters separated by a blank line. Character references are now decoded. Entries are inflated with a bounded output size, and an EPUB whose content exceeds 100 MiB uncompressed (the indexing.maxDocumentSize default) is refused with a ValidationError.
csv-parse < 7.0.2 has a moderate advisory (prototype replacement via columns). Version 7 keeps the csv-parse/sync API that the CSV parser uses.
undici 8 requires Node.js >= 22.19, and libscope supports Node.js 20.
RobertLD
changed the title
|
This was referenced Oct 8, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR applies the open Dependabot updates on top of the 2.0 code on
main, in one branch.@types/node-cronis removed.Not included: #506 (undici 8). It requires Node >= 22.19, and libscope supports Node >= 20 and tests Node 20 in CI.
Security fixes
~/.libscope/models, which costs one re-download.Effect on alerts:
npm audit --omit=devnow reports only mammoth → argparse → sprintf-js (3 moderate). Only mammoth's own CLI uses argparse, so libscope does not reach it. The fullnpm auditalso reports vitepress → vite (docs tooling, not shipped).Checks: format:check passes, lint has 0 errors, typecheck passes, and 2,131 tests pass. build and docs:check pass. The Docker image was built and tested: health check, add + search, and an EPUB add.