Dashboard › craft › Session 0BmGcTAoXDxC
0BmGcTAoXDxCbYvUmLet's do this again, we have dependency upgrades that we need to look into
[]
[{"ghsa":"GHSA-vmf3-w455-68vh","manifest":"pnpm-lock.yaml","number":181,"package":"tar","patched":"7.5.16","severity":"medium","state":"open","summary":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","vulnerable_range":"\u003c= 7.5.15"},{"ghsa":"GHSA-vmf3-w455-68vh","manifest":"package.json","number":180,"package":"tar","patched":"7.5.16","severity":"medium","state":"open","summary":"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)","vulnerable_range":"\u003c= 7.5.15"},{"ghsa":"GHSA-hmw2-7cc7-3qxx","manifest":"pnpm-lock.yaml","number":179,"package":"form-data","patched":"4.0.6","severity":"high","state":"open","summary":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","vulnerable_range":"\u003e= 4.0.0, \u003c ...
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "in_progress",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix esbuild vulnerability (low, #167/#168)",
"status": "pending",
"priority": "medium"
}
]
0 security advisories, 12 open Dependabot alerts across 6 distinct CVEs. Let me analyze the dependency relationships to figure out how to fix each one.
<task id="ses_10c2a4a1cffeeEx2m7D1uRfssk" state="completed"> <task_result> Now I have all the data I need. Let me compile the complete analysis. --- ## Complete Vulnerability Analysis for getsentry/craft --- ### 1. `tar` (Medium — GHSA-vmf3-w455-68vh) **Alerts:** #180 (package.json), #181 (pnpm-lock.yaml) **Vulnerable:** `<= 7.5.15` | **Fix:** `>= 7.5.16` | Finding | Detail | |---|---| | **Type** | **Direct** devDependency | | **File** | `package.json` line 65: `"tar": "7.5.11"` (pinned, no caret/tilde) | | **Lockfile** | `pnpm-lock.yaml` line 6007: resolved `tar@7.5.11` | | **Resolved version** | `7.5.11` — vulnerable | **Fix:** Bump the pinned version in `package.json` line 65 from `7.5.11` to `7.5.16` (or `^7.5.16`), then `pnpm install`. This is a patch bump within the same major — **zero risk of breakage**. --- ### 2. `form-data` (High — GHSA-hmw2-7cc7-3qxx) **Alerts:** #178 (pnpm-lock.yaml, `>= 4.0.0 < 4.0.6`), #179 (pnpm-lock.yaml, `< 2.5.6`) **Two distinct ...
Excellent analysis. Let me now check if vite 7.3.5+ ships with esbuild >= 0.28.1 (which would resolve the esbuild alert as a side effect), and verify that form-data 2.5.6 exists on npm.
^0.27.0 ---LATEST--- 8.0.16
2.5.6 ---4.0.6--- 4.0.6
7.5.16
{
fdir: '^6.5.0',
rollup: '^4.43.0',
esbuild: '^0.27.0',
postcss: '^8.5.6',
picomatch: '^4.0.3',
tinyglobby: '^0.2.15'
}
---7.3.6+---
version = '7.3.5'
dependencies.esbuild = '^0.27.0'
So vite 7.3.5 still depends on esbuild@^0.27.0, meaning the esbuild alert (0.27.x < 0.28.1) won't be fixed by bumping vite alone. The fix for esbuild requires either an override to 0.28.1+ or waiting for vite 8.x. Since this is a low severity Windows-only dev server issue, let me check if vite 8 is compatible with vitest.
^6.0.0 || ^7.0.0 || ^8.0.0 ---vitest version--- 4.1.9
vite@8.0.12 '8.0.12' vite@8.0.13 '8.0.13' vite@8.0.14 '8.0.14' vite@8.0.15 '8.0.15' vite@8.0.16 '8.0.16'
(no output)
{
postcss: '^8.5.15',
rolldown: '1.0.3',
picomatch: '^4.0.4',
tinyglobby: '^0.2.17',
lightningcss: '^1.32.0'
}
Vite 8 dropped esbuild entirely (uses rolldown instead). So bumping to vite 8 would fix the esbuild alert, but it's a major version jump. Let me check if astro supports vite 8 for the docs project.
^7.3.2 ---astro latest--- version = '7.0.0' dependencies.vite = '^8.0.13'
Good data. Astro 6.4.6 uses vite@^7.3.2 (still 7.x), so for the docs project the esbuild issue would persist even after bumping astro. Astro 7.0.0 uses vite 8 (no esbuild), but that's a major bump for the docs site.
Let me now form the plan. The esbuild vulnerability is low severity and Windows-only dev server — I think the pragmatic approach is to fix everything else and either dismiss or accept the esbuild risk.
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175)",
"status": "pending",
"priority": "high"
},
{
"content": "Fix esbuild vulnerability (low, #167/#168)",
"status": "pending",
"priority": "medium"
}
]
Here's the plan for all 12 alerts:
| # | Package | Severity | Project | Type | Current | Fix | Action |
|---|---------|----------|---------|------|---------|-----|--------|
| tar | Medium | root | Direct | 7.5.11 | 7.5.16 | Bump pin in package.json |
| form-data (4.x) | High | root | Transitive via @types/node-fetch | 4.0.4 | 4.0.6 | pnpm.overrides |
| form-data (2.x) | High | root | Transitive via @google-cloud/storage->@types/request | 2.5.5 | 2.5.6 | pnpm.overrides |
| vite | High+Med | root | Transitive via vitest | 7.3.2 | 7.3.5 | pnpm.overrides |
| vite | High+Med | docs | Transitive via astro | 7.3.2 | 7.3.5 | docs/pnpm.overrides or astro bump |
| astro | High+Med | docs | Direct | 6.3.3 | 6.4.6 | pnpm update (specifier ^6.1.10 allows it) |
| esbuild | Low | both | Transitive via vite@7.x | 0.27.7 | 0.28.1 | See below |
The esbuild alert (>= 0.27.3 < 0.28.1) is tricky:
vite@7.3.5 still depends on esbuild@^0.27.0 — bumping vite within 7.x won't fix itvite@8.0 dropped esbuild entirely (uses rolldown), but that's a major version jumpvitest supports vite 8, but astro@6.x only supports vite 7 — astro 7.0 uses vite 8Recommendation: Dismiss the 2 esbuild alerts as "not applicable" (Craft is a CLI tool, not a dev server; the vulnerability requires Windows + dev server mode). Fix everything else.
Does this plan sound right, or would you prefer to also force the esbuild override / major astro bump?
yup
M .lore.md Your branch is up to date with 'origin/master'. Already on 'master' package.json | 2 +- pnpm-lock.yaml | 561 ++++++++++++++++++++++++++++++--------------------------- 3 files changed, 301 insertions(+), 268 deletions(-)
Switched to a new branch 'byk/fix/dependabot-security-alerts' M .lore.md branch 'byk/fix/dependabot-security-alerts' set up to track 'origin/master'.
Good, on a fresh branch. Let me start fixing everything. First, read the current state of both package.json files to make precise edits.
<path>/home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon/package.json</path>
<type>file</type>
<content>
60: "shell-quote": "^1.8.4",
61: "simple-git": "^3.33.0",
62: "source-map-support": "^0.5.20",
63: "split": "1.0.1",
64: "string-length": "3.1.0",
65: "tar": "7.5.11",
66: "tmp": "^0.2.6",
67: "tslib": "^2.8.1",
68: "typescript": "^5.7.2",
69: "typescript-eslint": "^8.18.2",
70: "vitest": "^4.1.0",
71: "yargs": "^18",
72: "zod": "^3.24.1"
73: },
74: "scripts": {
75: "build:fat": "tsc -p tsconfig.build.json",
76: "build:watch": "tsc -p tsconfig.build.json --watch",
77: "build": "node build.mjs",
78: "precli": "pnpm build",
79: "cli": "node -r source-map-support/register dist/craft",
80: "clean": "rm -rf dist coverage",
81: "lint": "eslint --cache --cache-strategy content",
82: "fix": "pnpm lint --fix",
83: "format": "prettier --write .",
84: ...
<path>/home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon/docs/package.json</path>
<type>file</type>
<content>
1: {
2: "name": "craft-docs",
3: "version": "1.0.0",
4: "private": true,
5: "scripts": {
6: "dev": "astro dev",
7: "build": "astro build",
8: "preview": "astro preview"
9: },
10: "dependencies": {
11: "@astrojs/starlight": "^0.38.3",
12: "astro": "^6.1.10",
13: "sharp": "^0.33.5"
14: },
15: "pnpm": {
16: "overrides": {
17: "h3": "^1.15.6",
18: "devalue": "^5.8.1",
19: "rollup": "^4.59.0",
20: "svgo": "^4.0.1",
21: "smol-toml": "^1.6.1",
22: "defu": "^6.1.5"
23: }
24: }
25: }
(End of file - total 25 lines)
</content>
Now I have the current state of both files. Let me make all the edits.
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181) — bump 7.5.11 to 7.5.16",
"status": "in_progress",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179) — add overrides",
"status": "pending",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177) — add overrides",
"status": "pending",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175) — pnpm update in docs",
"status": "pending",
"priority": "high"
},
{
"content": "Dismiss esbuild alerts (low, #167/#168) — Windows dev server only, not applicable",
"status": "pending",
"priority": "medium"
},
{
"content": "Regenerate lockfiles and verify",
"status": "pending",
"priority": "high"
}
]
Let me make all the package.json edits in parallel — tar bump + form-data/vite overrides in root, and vite override in docs.
Edit applied successfully.
Edit applied successfully.
Edit applied successfully.
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181) — bump 7.5.11 to 7.5.16",
"status": "completed",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179) — add overrides",
"status": "completed",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177) — add overrides",
"status": "completed",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175) — pnpm update in docs",
"status": "in_progress",
"priority": "high"
},
{
"content": "Dismiss esbuild alerts (low, #167/#168) — Windows dev server only, not applicable",
"status": "pending",
"priority": "medium"
},
{
"content": "Regenerate lockfiles and verify",
"status": "pending",
"priority": "high"
}
]
Now let me regenerate both lockfiles — root install and docs astro update in parallel.
Progress: resolved 1, reused 0, downloaded 0, added 0
WARN deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
Progress: resolved 65, reused 64, downloaded 0, added 0
Progress: resolved 210, reused 159, downloaded 0, added 0
Progress: resolved 427, reused 391, downloaded 0, added 0
Progress: resolved 590, reused 556, downloaded 2, added 0
WARN 4 deprecated subdependencies found: @types/ci-info@3.1.4, @types/minipass@3.3.5, @types/parse-path@7.1.0, glob@9.3.5
Progress: resolved 651, reused 569, downloaded 2, added 0
Packages: +13 -11
+++++++++++++-----------
Progress: resolved 651, reused 569, downloaded 2, added 13, done
WARN Issues with peer dependencies found
.
└─┬ vitest 4.1.8
├── ✕ unmet peer vite@^7.3.5: found 7.3.2
└─┬ @vitest/mocker 4.1.8
└── ✕ unmet ...
Progress: resolved 1, reused 0, downloaded 0, added 0 Progress: resolved 103, reused 83, downloaded 0, added 0 Progress: resolved 262, reused 185, downloaded 0, added 0 Progress: resolved 422, reused 347, downloaded 1, added 0 Progress: resolved 466, reused 376, downloaded 4, added 0 Progress: resolved 471, reused 376, downloaded 6, added 0 Packages: +102 -105 +++++++++++++++++++++++++++++++++++++++----------------------------------------- Progress: resolved 471, reused 376, downloaded 6, added 7 Progress: resolved 471, reused 376, downloaded 6, added 63 Progress: resolved 471, reused 376, downloaded 6, added 102, done dependencies: - @astrojs/starlight 0.37.3 + @astrojs/starlight 0.38.3 - astro 5.16.11 + astro 6.4.8 (7.0.0 is available) ╭ Warning ─────────────────────────────────────────────────────────────────────╮ │ │ │ Ignored build scripts: esbuild@0.27.7. ...
Interesting results:
Root project: tar bumped to 7.5.16, and esbuild bumped from 0.25.12 to 0.28.1 (the override on vite pulled this in). But there's a peer dep warning — vitest expects vite@^7.3.5 but found 7.3.2. The vite override didn't seem to take effect properly. Let me investigate.
Docs project: astro bumped from 5.16.11 to 6.4.8 (even better than 6.4.6). @astrojs/starlight also bumped.
Let me check the vite resolution in the root lockfile and fix the peer dep issue.
211: version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0)) 2881: vite@7.3.2: 4885: '@vitest/mocker@4.1.8(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0))': 6120: vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0): 6133: vitest@4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0)): 6136: '@vitest/mocker': 4.1.8(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0))
1866: vite@7.3.5: 2765: vitefu: 1.1.3(vite@7.3.5(@types/node@25.0.3)) 4375: vite@7.3.5(@types/node@25.0.3): 4387: vitefu@1.1.3(vite@7.3.5(@types/node@25.0.3)):
The docs lockfile correctly resolved vite to 7.3.5, but the root lockfile is still stuck on vite 7.3.2. The override isn't forcing the resolution. Let me try a more aggressive approach — delete the lockfile entry and reinstall.
Progress: resolved 0, reused 1, downloaded 0, added 0
WARN deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
Progress: resolved 319, reused 294, downloaded 0, added 0
Progress: resolved 592, reused 560, downloaded 0, added 0
WARN 4 deprecated subdependencies found: @types/ci-info@3.1.4, @types/minipass@3.3.5, @types/parse-path@7.1.0, glob@9.3.5
Packages: +4 -4
++++----
Progress: resolved 651, reused 571, downloaded 0, added 0
Progress: resolved 651, reused 571, downloaded 0, added 4, done
WARN Issues with peer dependencies found
.
└─┬ vitest 4.1.8
├── ✕ unmet peer vite@^7.3.5: found 7.3.2
└─┬ @vitest/mocker 4.1.8
└── ✕ unmet peer vite@^7.3.5: found 7.3.2
╭ Warning ─────────────────────────────────────────────────────────────────────╮
│ ...
The override isn't working for vite. This is likely because vite is not a direct dependency — it's pulled in by vitest as a peer dep, and pnpm overrides with the simple name may not affect the resolved peer. Let me check if the override even appears in the lockfile.
overrides: fast-xml-parser: ^5.8.0 minimatch: ^10.2.1
overrides:
fast-xml-parser: ^5.8.0
minimatch: ^10.2.1
ajv@<6.14.0: ^6.14.0
postcss: ^8.5.10
rollup: ^4.59.0
flatted: ^3.4.2
picomatch@<3: ^2.3.2
uuid: ^14.0.0
'@tootallnate/once': ^2.0.1
form-data@>=4: ^4.0.6
form-data@<3: ^2.5.6
vite: ^7.3.5
importers:
.:
dependencies:
fastest-levenshtein:
specifier: ^1.0.16
version: 1.0.16
The overrides are in the lockfile, but vite is still resolving to 7.3.2. This might be because pnpm 10 handles overrides differently for packages that are already locked. Let me try a clean install.
Lockfile is up to date, resolution step is skipped Progress: resolved 1, reused 0, downloaded 0, added 0 Packages: +571 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Progress: resolved 571, reused 571, downloaded 0, added 17 Progress: resolved 571, reused 571, downloaded 0, added 381 Progress: resolved 571, reused 571, downloaded 0, added 571, done dependencies: + fastest-levenshtein 1.0.16 + ignore 7.0.5 + marked 17.0.1 + p-limit 6.2.0 + semver 7.7.3 devDependencies: + @aws-sdk/client-lambda 3.984.0 + @eslint/js 9.39.2 + @google-cloud/storage 7.18.0 + @octokit/plugin-retry 7.2.1 + @octokit/request-error 7.0.0 + @octokit/rest 21.1.1 + @sentry/esbuild-plugin 2.23.1 + @sentry/node 10.27.0 + @types/async 3.2.25 + @types/aws4 1.11.6 + @types/cli-table 0.3.4 + @types/git-url-parse 9.0.3 + @types/is-ci 2.0.0 + @types/js-yaml 4.0.9 + @types/mkdirp 1.0.2 + @types/node 22.19.1 + @types/node-fetch 2.6.13 + @types/ora 1.3.5 + @types/prompts 2.4.9 + ...
The lockfile says "up to date" — the override is registered but isn't re-resolving the existing locked version. I need to delete the lockfile and regenerate from scratch to force the resolution.
211: version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0)) 2881: vite@7.3.2: 4885: '@vitest/mocker@4.1.8(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0))': 6120: vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0): 6133: vitest@4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0)): 6136: '@vitest/mocker': 4.1.8(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0))
Still 7.3.2. The override isn't taking effect because pnpm treats the existing lockfile entry as satisfying the constraint (7.3.2 matches ^7.3.5... actually no, it doesn't). Let me try removing the lockfile and regenerating.
Progress: resolved 0, reused 1, downloaded 0, added 0
WARN deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
Progress: resolved 199, reused 173, downloaded 0, added 0
Progress: resolved 569, reused 534, downloaded 0, added 0
WARN 4 deprecated subdependencies found: @types/ci-info@3.1.4, @types/minipass@3.3.5, @types/parse-path@7.1.0, glob@9.3.5
Progress: resolved 651, reused 571, downloaded 0, added 0
Already up to date
Progress: resolved 651, reused 571, downloaded 0, added 0, done
WARN Issues with peer dependencies found
.
└─┬ vitest 4.1.8
├── ✕ unmet peer vite@^7.3.5: found 7.3.2
└─┬ @vitest/mocker 4.1.8
└── ✕ unmet peer vite@^7.3.5: found 7.3.2
Done in 5.8s using pnpm v10.28.0
Even with a fresh lockfile, vite resolves to 7.3.2. The peer dep warning says vitest expects ^7.3.5 but found 7.3.2 — that means vitest's peer dep range actually requires ^7.3.5, yet pnpm is resolving 7.3.2 anyway. The override isn't working as expected for peer dependencies. Let me check vitest's actual peer dep constraint and see if the issue is that vite is installed as an optional peer.
{
vite: '^6.0.0 || ^7.0.0 || ^8.0.0',
jsdom: '*',
'happy-dom': '*',
'@vitest/ui': '4.1.8',
'@types/node': '^20.0.0 || ^22.0.0 || >=24.0.0',
'@edge-runtime/vm': '*',
'@opentelemetry/api': '^1.9.0',
'@vitest/coverage-v8': '4.1.8',
'@vitest/browser-preview': '4.1.8',
'@vitest/coverage-istanbul': '4.1.8',
'@vitest/browser-playwright': '4.1.8',
'@vitest/browser-webdriverio': '4.1.8'
}
Vitest's peer dep is ^6.0.0 || ^7.0.0 || ^8.0.0 — it accepts any vite 7.x. The ^7.3.5 in the warning must be coming from somewhere else. The override is in the lockfile header but pnpm seems to not apply it to peer dep resolutions. Let me check if vite is listed as a dependency of something else in the resolved lockfile, and try adding vite as a direct devDependency to force the resolution.
vitest:
specifier: ^4.1.0
version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.2(@types/node@22.19.1)(tsx@4.21.0))
yargs:
specifier: ^18
version: 18.0.0
zod:
specifier: ^3.24.1
--
hasBin: true
vite@7.3.2:
resolution: {integrity: sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==}
engines: {node: ^20.19.0 || >=22.12.0}
hasBin: true
peerDependencies:
'@types/node': ^20.19.0 || >=22.12.0
--
tinyrainbow: 3.1.0
I see — vite is resolved as a transitive peer dep with autoInstallPeers. The override is present in the lockfile header but pnpm isn't applying it to the auto-installed peer. Let me try a different approach: add vite as a direct devDependency, which will force the version.
Updated 1 path from the index Progress: resolved 1, reused 0, downloaded 0, added 0 WARN deprecated glob@11.1.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me Progress: resolved 194, reused 161, downloaded 0, added 0 Progress: resolved 505, reused 469, downloaded 0, added 0 WARN 4 deprecated subdependencies found: @types/ci-info@3.1.4, @types/minipass@3.3.5, @types/parse-path@7.1.0, glob@9.3.5 Progress: resolved 651, reused 571, downloaded 0, added 0 Packages: +7 -7 +++++++------- Progress: resolved 651, reused 571, downloaded 0, added 7, done devDependencies: + vite 7.3.5 (8.0.16 is available) Done in 5.4s using pnpm v10.28.0
That worked — vite is now at 7.3.5. Let me verify and also remove the now-unnecessary vite override from package.json since vite is a direct dep.
214: version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.5(@types/node@22.19.1)(tsx@4.21.0)) 2884: vite@7.3.5: 4888: '@vitest/mocker@4.1.8(vite@7.3.5(@types/node@22.19.1)(tsx@4.21.0))': 6123: vite@7.3.5(@types/node@22.19.1)(tsx@4.21.0): 6136: vitest@4.1.8(@opentelemetry/api@1.9.0)(@types/node@22.19.1)(vite@7.3.5(@types/node@22.19.1)(tsx@4.21.0)): 6139: '@vitest/mocker': 4.1.8(vite@7.3.5(@types/node@22.19.1)(tsx@4.21.0))
Vite is now properly at 7.3.5 everywhere in the root lockfile. Now let me clean up — remove the vite override from package.json since it's now a direct devDependency, and verify the current state of package.json.
<path>/home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon/package.json</path>
<type>file</type>
<content>
60: "shell-quote": "^1.8.4",
61: "simple-git": "^3.33.0",
62: "source-map-support": "^0.5.20",
63: "split": "1.0.1",
64: "string-length": "3.1.0",
65: "tar": "7.5.16",
66: "tmp": "^0.2.6",
67: "tslib": "^2.8.1",
68: "typescript": "^5.7.2",
69: "typescript-eslint": "^8.18.2",
70: "vite": "^7.3.5",
71: "vitest": "^4.1.0",
72: "yargs": "^18",
73: "zod": "^3.24.1"
74: },
75: "scripts": {
76: "build:fat": "tsc -p tsconfig.build.json",
77: "build:watch": "tsc -p tsconfig.build.json --watch",
78: "build": "node build.mjs",
79: "precli": "pnpm build",
80: "cli": "node -r source-map-support/register dist/craft",
81: "clean": "rm -rf dist coverage",
82: "lint": "eslint --cache --cache-strategy content",
83: "fix": "pnpm lint --fix",
84: "format": ...
Good — pnpm add -D vite@^7.3.5 added it to devDependencies (line 70) and it's also in overrides (line 116). The override is redundant now since it's a direct dep, but it doesn't hurt and ensures any transitive copies also get pinned. I'll leave both.
Now let me also check the esbuild situation — the root project earlier showed esbuild 0.28.1 being installed, which would fix alerts #167. Let me verify and check the docs lockfile too.
1991: esbuild@0.27.7: 1996: esbuild@0.28.1: 5169: esbuild@0.27.7: 5198: esbuild@0.28.1:
1029: esbuild@0.27.7: 2963: esbuild@0.27.7:
Root still has both esbuild@0.27.7 (from vite's dependency) AND esbuild@0.28.1 (direct devDep). The vulnerable 0.27.7 copy persists as a transitive dep of vite 7.3.5. And docs has only esbuild@0.27.7.
Since vite 7.3.5 pins esbuild: ^0.27.0, the 0.27.7 copy can't be eliminated without either an override or a vite major bump. Given the vulnerability is low severity and Windows dev-server only, let me dismiss those alerts. Let me first verify the form-data fix is working.
17: form-data@>=4: ^4.0.6 18: form-data@<3: ^2.5.6 2129: form-data@2.5.6: 2133: form-data@4.0.6: 5365: form-data@2.5.6: 5374: form-data@4.0.6:
22: version: 0.38.3(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2)) 842: astro@6.4.8: 2035: '@astrojs/mdx@5.0.4(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2))': 2068: '@astrojs/starlight@0.38.3(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2))': 2071: '@astrojs/mdx': 5.0.4(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2)) 2078: astro-expressive-code: 0.41.6(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2)) 2707: astro-expressive-code@0.41.6(astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2)): 2712: astro@6.4.8(@types/node@25.0.3)(rollup@4.62.2):
All the important fixes are in place:
2.5.6 and 4.0.6 (both patched)6.4.8 (patched, >= 6.4.6)7.3.5 in both root and docs lockfiles7.5.16 (patched)Now let me run verification and dismiss the esbuild alerts.
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181) — bump 7.5.11 to 7.5.16",
"status": "completed",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179) — add overrides",
"status": "completed",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177) — direct devDep + override",
"status": "completed",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175) — bumped to 6.4.8",
"status": "completed",
"priority": "high"
},
{
"content": "Dismiss esbuild alerts (low, #167/#168) — Windows dev server only, not applicable",
"status": "in_progress",
"priority": "medium"
},
{
"content": "Verify: build, test, lint",
"status": "pending",
"priority": "high"
},
{
...
jq: parse error: Invalid numeric literal at line 1, column 317
{
"number": null,
"state": null,
"dismissed_reason": null
}
jq: parse error: Invalid numeric literal at line 1, column 407
{
"number": null,
"state": null,
"dismissed_reason": null
}
The jq parsing failed on the response. Let me check if the dismissals actually went through.
{"dismissed_reason":null,"number":167,"state":"open"}
---168---
{"dismissed_reason":null,"number":168,"state":"open"}
The dismissals didn't go through. The issue is likely the em-dash in the comment. Let me retry with simpler ASCII text.
{"message":"Invalid request.\n\nInvalid property /dismissed_reason: `not_impacted` is not a possible value. Must be one of the following: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk.","documentation_url":"https://docs.github.com/rest/dependabot/alerts#update-a-dependabot-alert","status":"422"}gh: Invalid request.
Invalid property /dismissed_reason: `not_impacted` is not a possible value. Must be one of the following: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk. (HTTP 422)
{"message":"Invalid request.\n\nInvalid property /dismissed_reason: `not_impacted` is not a possible value. Must be one of the following: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk.","documentation_url":"https://docs.github.com/rest/dependabot/alerts#update-a-dependabot-alert","status":"422"}gh: Invalid request.
Invalid property /dismissed_reason: `not_impacted` is not a possible value. Must be one of the following: fix_started, inaccurate, no_bandwidth, not_used, tolerable_risk. (HTTP 422)
Wrong enum value. Let me use tolerable_risk.
{"dismissed_reason":"tolerable_risk","number":167,"state":"dismissed"}
{"dismissed_reason":"tolerable_risk","number":168,"state":"dismissed"}
Both esbuild alerts dismissed. Now let me verify everything builds and tests pass.
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181) — bump 7.5.11 to 7.5.16",
"status": "completed",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179) — add overrides",
"status": "completed",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177) — direct devDep + override",
"status": "completed",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175) — bumped to 6.4.8",
"status": "completed",
"priority": "high"
},
{
"content": "Dismiss esbuild alerts (low, #167/#168) — Windows dev server only, tolerable_risk",
"status": "completed",
"priority": "medium"
},
{
"content": "Verify: build, test, lint",
"status": "in_progress",
"priority": "high"
},
{
...
> @sentry/craft@2.27.0-dev.0 build /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon > node build.mjs [build] SENTRY_AUTH_TOKEN not found, skipping source map upload
> @sentry/craft@2.27.0-dev.0 lint /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon > eslint --cache --cache-strategy content /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon/src/commands/publish.ts 441:14 warning '_abortError' is defined but never used @typescript-eslint/no-unused-vars 458:14 warning '_abortError' is defined but never used @typescript-eslint/no-unused-vars 474:16 warning '_statusError' is defined but never used @typescript-eslint/no-unused-vars 480:18 warning '_diffError' is defined but never used @typescript-eslint/no-unused-vars 486:16 warning '_abortError' is defined but never used @typescript-eslint/no-unused-vars /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon/src/utils/git.ts 220:12 warning '_err' is defined but never used @typescript-eslint/no-unused-vars 228:12 warning '_err' ...
Build and lint pass. Now tests.
> @sentry/craft@2.27.0-dev.0 test /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon > vitest run RUN v4.1.8 /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon [info] [[target/github]] No previous release found [info] [[target/github]] Deleted orphaned draft release: v1.0.0 [info] [[target/github]] No previous release found [warn] [[target/github]] Failed to clean up release "v1.0.0": Error: Cleanup failed [info] [[target/github]] No previous release found [info] [[target/github]] No previous release found [info] [[target/github]] Release for tag "1.0.0" already exists and is published. Skipping GitHub release creation (likely from a previous run). [info] [[target/github]] No previous release found [info] [[target/github]] createRelease returned 422 for tag "1.0.0". Looking for a leftover draft release to clean up... ...
All 57 test files passed (1025 tests, 1 skipped). Even the prepare-dry-run e2e tests passed this time. Let me also verify the docs build.
10:12:41 ▶ /_astro/logo.BI85AlWL_Z1HYzg2.svg (before: 10kB, after: 10kB) (+67ms) (1/1) 10:12:41 ✓ Completed in 67ms. 10:12:41 [build] ✓ Completed in 6.90s. 10:12:41 [starlight:pagefind] Building search index with Pagefind... 10:12:42 [starlight:pagefind] Found 27 HTML files. 10:12:42 [starlight:pagefind] Finished building search index in 322ms. 10:12:42 [@astrojs/sitemap] `sitemap-index.xml` created at `dist` 10:12:42 [build] 27 page(s) built in 11.02s 10:12:42 [build] Complete!
Everything passes — build, tests, lint, and docs build. Now let me commit, push, and create the PR.
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181) — bump 7.5.11 to 7.5.16",
"status": "completed",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179) — add overrides",
"status": "completed",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177) — direct devDep + override",
"status": "completed",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175) — bumped to 6.4.8",
"status": "completed",
"priority": "high"
},
{
"content": "Dismiss esbuild alerts (low, #167/#168) — Windows dev server only, tolerable_risk",
"status": "completed",
"priority": "medium"
},
{
"content": "Verify: build, test, lint",
"status": "completed",
"priority": "high"
},
{
...
.lore.md | 310 ++++-------------------------------------------- docs/package.json | 5 +- docs/pnpm-lock.yaml | 334 +++++++++++++++++++++++++++++----------------------- package.json | 10 +- pnpm-lock.yaml | 81 ++++++------- 5 files changed, 256 insertions(+), 484 deletions(-) ---LORE--- .lore.md | 310 +++++---------------------------------------------------------- 1 file changed, 24 insertions(+), 286 deletions(-)
[byk/fix/dependabot-security-alerts 3609b2e] fix: resolve 10 Dependabot security alerts 5 files changed, 256 insertions(+), 484 deletions(-)
remote: remote: Create a pull request for 'byk/fix/dependabot-security-alerts' on GitHub by visiting: remote: https://github.com/getsentry/craft/pull/new/byk/fix/dependabot-security-alerts remote: remote: GitHub found 10 vulnerabilities on getsentry/craft's default branch (5 high, 5 moderate). To find out more, visit: remote: https://github.com/getsentry/craft/security/dependabot remote: To https://github.com/getsentry/craft.git * [new branch] byk/fix/dependabot-security-alerts -> byk/fix/dependabot-security-alerts branch 'byk/fix/dependabot-security-alerts' set up to track 'origin/byk/fix/dependabot-security-alerts'.
Warning: 1 uncommitted change https://github.com/getsentry/craft/pull/836
PR created: https://github.com/getsentry/craft/pull/836
Now let me watch CI and force-merge when it passes.
enforce-license-compliance pass 35s https://github.com/getsentry/craft/actions/runs/28019023073/job/82930387221 image pass 4m39s https://github.com/getsentry/craft/actions/runs/28019022661/job/82930386033 preview pass 24s https://github.com/getsentry/craft/actions/runs/28019022693/job/82930386359 preview pass 9s https://github.com/getsentry/craft/actions/runs/28019022941/job/82930386806 semgrep-cloud-platform/scan pass 4m47s https://semgrep.dev/orgs/sentry/projects/2706060/scans/184537820 warden pass 30s https://github.com/getsentry/craft/actions/runs/28019022694/job/82930406160 warden pass 0 https://warden.sentry.dev warden: security-review pass 0 https://warden.sentry.dev Lint fixes fail 22s https://github.com/getsentry/craft/actions/runs/28019022778/job/82930383963 Analyze (actions) pass 51s https://github.com/getsentry/craft/actions/runs/28019018979/job/82930379907 Analyze ...
One failure — Lint fixes. Let me check what it found.
Lint fixes Format Check 2026-06-23T10:16:04.2461839Z ##[group]Run pnpm format:check
Lint fixes Format Check 2026-06-23T10:16:04.2462023Z ^[[36;1mpnpm format:check^[[0m
Lint fixes Format Check 2026-06-23T10:16:04.2487717Z shell: /usr/bin/bash -e {0}
Lint fixes Format Check 2026-06-23T10:16:04.2487854Z env:
Lint fixes Format Check 2026-06-23T10:16:04.2487997Z PNPM_HOME: /home/runner/setup-pnpm/node_modules/.bin
Lint fixes Format Check 2026-06-23T10:16:04.2488164Z ##[endgroup]
Lint fixes Format Check 2026-06-23T10:16:04.3892610Z
Lint fixes Format Check 2026-06-23T10:16:04.3893369Z > @sentry/craft@2.27.0-dev.0 format:check /home/runner/work/craft/craft
Lint fixes Format Check 2026-06-23T10:16:04.3893644Z > prettier --check .
Lint fixes Format Check 2026-06-23T10:16:04.3893737Z
Lint fixes Format Check 2026-06-23T10:16:04.4398073Z Checking formatting...
Lint fixes Format Check 2026-06-23T10:16:04.5776385Z [^[[33mwarn^[[39m] .lore.md
Lint fixes Format Check 2026-06-23T10:16:06.7687543Z ...
It's just .lore.md formatting. Let me fix it and amend the commit.
> @sentry/craft@2.27.0-dev.0 format:check /home/byk/.local/share/opencode/worktree/55fa901aca64a01fa4b5c2abce1c85c1c27475e7/stellar-falcon > prettier --check . Checking formatting...
.lore.md 530ms [byk/fix/dependabot-security-alerts 5d23e76] fix: resolve 10 Dependabot security alerts Date: Tue Jun 23 10:13:27 2026 +0000 5 files changed, 244 insertions(+), 454 deletions(-)
remote: remote: GitHub found 10 vulnerabilities on getsentry/craft's default branch (5 high, 5 moderate). To find out more, visit: remote: https://github.com/getsentry/craft/security/dependabot remote: To https://github.com/getsentry/craft.git + 3609b2e...5d23e76 byk/fix/dependabot-security-alerts -> byk/fix/dependabot-security-alerts (forced update)
Pushed. Let me watch CI again.
enforce-license-compliance pass 31s https://github.com/getsentry/craft/actions/runs/28019406952/job/82931680423 image pass 5m26s https://github.com/getsentry/craft/actions/runs/28019407006/job/82931680439 preview pass 13s https://github.com/getsentry/craft/actions/runs/28019406832/job/82931680074 preview pass 30s https://github.com/getsentry/craft/actions/runs/28019406867/job/82931680332 semgrep-cloud-platform/scan pass 4m47s https://semgrep.dev/orgs/sentry/projects/2706060/scans/184541154 warden pass 28s https://github.com/getsentry/craft/actions/runs/28019407025/job/82931698974 warden pass 0 https://warden.sentry.dev warden: security-review pass 0 https://warden.sentry.dev Analyze (actions) pass 42s https://github.com/getsentry/craft/actions/runs/28019403875/job/82931672934 Analyze ...
All checks pass, including Lint fixes this time. Force-merging now.
From https://github.com/getsentry/craft * branch master -> FETCH_HEAD 8f37246..67eb802 master -> origin/master Updating 8f37246..67eb802 Fast-forward .lore.md | 268 ++--------------------------------------- docs/package.json | 5 +- docs/pnpm-lock.yaml | 334 +++++++++++++++++++++++++++++----------------------- package.json | 10 +- pnpm-lock.yaml | 81 ++++++------- 5 files changed, 244 insertions(+), 454 deletions(-)
[
{
"content": "Analyze 12 open Dependabot alerts and create fix plan",
"status": "completed",
"priority": "high"
},
{
"content": "Fix tar vulnerability (medium, #180/#181) — bump 7.5.11 to 7.5.16",
"status": "completed",
"priority": "high"
},
{
"content": "Fix form-data vulnerability (high, #178/#179) — add overrides",
"status": "completed",
"priority": "high"
},
{
"content": "Fix vite vulnerability (high+medium, #172/#173/#176/#177) — direct devDep + override",
"status": "completed",
"priority": "high"
},
{
"content": "Fix astro vulnerabilities (high+medium, #174/#175) — bumped to 6.4.8",
"status": "completed",
"priority": "high"
},
{
"content": "Dismiss esbuild alerts (low, #167/#168) — Windows dev server only, tolerable_risk",
"status": "completed",
"priority": "medium"
},
{
"content": "Verify: build, test, lint",
"status": "completed",
"priority": "high"
},
{
...
PR #836 merged. https://github.com/getsentry/craft/pull/836
10 Dependabot alerts resolved, 2 dismissed:
| Action | Package | Alerts | Severity |
|--------|---------|--------|----------|
| Bump 7.5.11 -> 7.5.16 | tar | #180, #181 | Medium |
| Override 4.0.6 + 2.5.6 | form-data | #178, #179 | High |
| Direct devDep ^7.3.5 + override | vite (root) | #172, #176 | High + Medium |
| Override ^7.3.5 | vite (docs) | #173, #177 | High + Medium |
| Update 6.4.8 | astro | #174, #175 | High + Medium |
| Dismissed (tolerable_risk) | esbuild | #167, #168 | Low |
Want me to cut a release for this too?
yes please
https://github.com/getsentry/craft/actions/runs/28021800167 triggered
✓ Run actions/checkout@v6 ✓ Run actions/setup-node@v6 ✓ Get pnpm version from Volta config ✓ Run pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 ✓ Build Docs ✓ Package Docs ✓ Upload Docs Artifact ✓ Post Run pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 ✓ Post Run actions/setup-node@v6 ✓ Post Run actions/checkout@v6 ✓ Complete job ✓ Release a new version in 19s (ID 82939886394) ✓ Set up job ✓ Get auth token ✓ Run actions/checkout@v6 ✓ Prepare release (dogfooding) - Prepare release ✓ Post Run actions/checkout@v6 ✓ Post Get auth token ✓ Complete job ===EXIT 0===
Release workflow passed. Let me find the publish request and approve it.
{"completedAt":"2026-06-23T11:09:33Z","conclusion":"success","name":"Prepare release (dogfooding)","number":4,"startedAt":"2026-06-23T11:09:25Z","status":"completed"}
---BRANCH---
f245d27b2539bef2c329a7e6c608b89f3e1001cf refs/heads/release/2.26.11
{"number":8655,"state":"OPEN","title":"publish: getsentry/craft@2.26.11"}
https://github.com/getsentry/publish/issues/8655
Release 2.26.11 is approved and publishing. getsentry/publish#8655
Targets being published: npm, GCS, registry, Docker (release + latest), GitHub release, and gh-pages.
publish failed, can you check why
{"commentCount":4,"labels":["ci-ready"],"state":"OPEN","title":"publish: getsentry/craft@2.26.11"}
The label changed to "ci-ready" instead of "accepted," so I need to check the comments to see what went wrong.
Let me check the comments on the publish issue to see the failure details.
{"author":"github-actions","body":"Approved. Checking CI status on the release branch. Publishing will start automatically when CI passes."}
{"author":"getsantry","body":"CI checks passed for getsentry/craft@2.26.11. Publishing is starting now."}
{"author":"github-actions","body":"Publishing: [run#28022314969](https://github.com/getsentry/publish/actions/runs/28022314969)"}
{"author":"github-actions","body":"Failed to publish. ([run logs](https://github.com/getsentry/publish/actions/runs/28022314969?check_suite_focus=true#step:8))\n\n_Bad branch? You can [delete with ease](https://github.com/getsentry/craft/branches/all?query=2.26.11) and start over._"}
Publishing failed. Let me check the failure logs from that run.
X main Publish · 28022314969 Triggered via issues about 34 minutes ago JOBS X Publish a new version in 2m24s (ID 82941409241) ✓ Set up job ✓ Pull getsentry/craft:latest ✓ Get repo contents ✓ Setup Node ✓ Install yarn dependencies ✓ Parse and set inputs ✓ Inform start - Set target repo checkout branch ✓ Get Release Bot auth token ✓ Check out target repo ✓ Set targets X Publish using Craft ✓ Update completed targets and remove label - Inform about cancellation ✓ Inform about failure - Close on success ✓ Post Check out target repo ✓ Post Get Release Bot auth token - Post Setup Node ✓ Post Get repo contents ✓ Complete job - Waiting for CI in 0s (ID 82941410259) To see what failed, try: gh run view 28022314969 --log-failed View this run on GitHub: https://github.com/getsentry/publish/actions/runs/28022314969
The "Publish using Craft" step failed. Let me see the detailed log.
Publish a new version Publish using Craft 2026-06-23T11:19:14.4725558Z [info] [[target/npm]] Releasing sentry-craft-2.26.11.tgz to NPM Publish a new version Publish using Craft 2026-06-23T11:19:16.6354028Z [info] npm: + @sentry/craft@2.26.11 Publish a new version Publish using Craft 2026-06-23T11:19:16.6906165Z [info] npm: Publish a new version Publish using Craft 2026-06-23T11:19:16.6922658Z [info] [[target/npm]] NPM release complete Publish a new version Publish using Craft 2026-06-23T11:19:16.6928916Z [info] Publish a new version Publish using Craft 2026-06-23T11:19:16.6930248Z [info] ================================= Publish a new version Publish using Craft 2026-06-23T11:19:16.6932186Z [info] === Publishing to target: gcs === Publish a new version Publish using Craft 2026-06-23T11:19:16.6933417Z [info] ================================= Publish a new version Publish using Craft 2026-06-23T11:19:16.6939685Z [info] [[target/gcs]] Uploading to GCS bucket: ...
The publish actually succeeded across most targets—npm, GCS, and the registry all went through fine. The docker failure is just a transient Docker Hub registry issue, not something caused by my code changes.
I need to check the issue's target checkboxes to see which ones are marked complete, then re-add the "accepted" label to retry the publish. Since the completed targets are already published, re-running should skip those and only retry the remaining docker targets and other channels.
This is not related to our dependency changes. The publish actually succeeded for npm, GCS, and registry — it failed on the docker[release] target due to a transient Docker Hub registry error:
docker.io/getsentry/craft:2.26.11: failed to copy: unexpected status from PUT request
to https://registry-1.docker.io/...: 400 Bad Request
A 400 Bad Request from Docker Hub during blob upload is an infrastructure flake. Let me check which targets already completed (Craft tracks these via checkboxes and skips them on retry).
### Targets - [ ] npm - [ ] gcs - [ ] registry - [ ] docker[release] - [ ] docker[latest] - [ ] github - [ ] gh-pages Checked targets will be skipped (either already published or user-requested skip). Uncheck to retry a target. ---
None of the target checkboxes are marked as complete even though npm, gcs, and registry all succeeded, which suggests the publish might be atomic—failing on any target prevents marking partial progress. But the logs clearly show those three targets finished successfully, so something's off with how the completion status is being tracked.
The real risk here is that if I retry by re-adding the "accepted" label, npm will attempt to republish version 2.26.11, which will fail with a 403 since that version already exists in the registry. I need to manually check the boxes for npm, gcs, and registry to skip them on retry, then leave docker, github, and gh-pages unchecked to retry only those. The docker error looks like a transient Docker Hub issue—likely rate limiting or a registry hiccup—so it's probably safe to retry.
None of the boxes are checked, but the logs show npm/gcs/registry succeeded. A blind retry would try to republish @sentry/craft@2.26.11 to npm, which fails (npm forbids overwriting an existing version). Let me verify what actually got published before retrying.
2.26.11
---DIST-TAGS---
{ latest: '2.26.11' }
I've confirmed npm@2.26.11 is published with the latest tag, so npm, gcs, and registry are all done. Now I need to mark those three as complete in the issue and re-add the "accepted" label to retry the remaining docker and github targets.
The docker failure was a 400 error during manifest copying, which is likely transient Docker Hub flakiness and should succeed on retry. Since docker[release] failed, the github and gh-pages targets never ran, so the GitHub release for 2.26.11 hasn't been created yet. Let me fetch the full issue body to update it.
Confirmed — @sentry/craft@2.26.11 is live on npm as latest. So npm, gcs, and registry all succeeded; only docker[release], docker[latest], github, and gh-pages remain.
To retry safely without npm rejecting a duplicate publish, I'll check the boxes for the 3 completed targets (Craft skips checked targets), then re-trigger. Let me get the full issue body.
Requested by: @BYK Merge target: (default) Quick links: - [View changes](https://github.com/getsentry/craft/compare/2.26.10...release/2.26.11) - [View check runs](https://github.com/getsentry/craft/commit/f245d27b2539bef2c329a7e6c608b89f3e1001cf/checks/) Assign the **accepted** label to this issue to approve the release. ### Targets - [ ] npm - [ ] gcs - [ ] registry - [ ] docker[release] - [ ] docker[latest] - [ ] github - [ ] gh-pages Checked targets will be skipped (either already published or user-requested skip). Uncheck to retry a target. --- <details open> <summary>📋 Changelog</summary> ### Bug Fixes 🐛 - Resolve 10 Dependabot security alerts by @BYK in [#836](https://github.com/getsentry/craft/pull/836) ### Internal Changes 🔧 - (deps-dev) Bump esbuild from 0.25.12 to 0.28.1 by @dependabot in [#834](https://github.com/getsentry/craft/pull/834) </details>
I'm going to update the issue body by checking off npm, gcs, and registry while leaving the docker variants, github, and gh-pages unchecked.
I'll mark npm, gcs, and registry as completed (checked), leaving the docker/github/gh-pages targets to retry.
Wrote file successfully.
https://github.com/getsentry/publish/issues/8655
I need to re-add the "accepted" label to trigger the retry, since the failure flow removed it and replaced it with "ci-ready". Let me add that label back.
Now re-add the accepted label to re-trigger the publish for the remaining targets (docker, github, gh-pages).
https://github.com/getsentry/publish/issues/8655
Let me wait for the retry publish to kick off and watch its progress.
{"author":"github-actions","body":"Failed to publish. ([run logs](https://github.com/getsentry/publish/actions/runs/28022314969?check_suite_focus=true#step:8))\n\n_Bad branch? You can [delete with ease](https://github.com/getsentry/craft/branches/all?query=2.26.11) and start over._"}
{"author":"github-actions","body":"Approved. Checking CI status on the release branch. Publishing will start automatically when CI passes."}
{"author":"getsantry","body":"CI checks passed for getsentry/craft@2.26.11. Publishing is starting now."}
The retry is publishing now. Let me find the new publish run and watch it.
{"conclusion":"","createdAt":"2026-06-23T11:59:09Z","id":28024530013,"status":"in_progress"}
{"conclusion":"skipped","createdAt":"2026-06-23T11:58:49Z","id":28024512749,"status":"completed"}
{"conclusion":"success","createdAt":"2026-06-23T11:58:35Z","id":28024500360,"status":"completed"}
Run Publish (28024530013) has already completed with 'success' ===EXIT 0===
The retry succeeded. Let me confirm the publish issue is now closed and all targets completed.
{"lastComments":[{"author":"github-actions","body":"Publishing: [run#28024530013](https://github.com/getsentry/publish/actions/runs/28024530013)"},{"author":"github-actions","body":"Published successfully: [run#28024530013](https://github.com/getsentry/publish/actions/runs/28024530013)"}],"state":"CLOSED"}
Resolved. Release 2.26.11 published successfully and the publish issue (#8655) is now closed.
The failure was not related to the dependency changes. The first publish run partially succeeded then hit a transient Docker Hub error:
docker.io/getsentry/craft:2.26.11: failed to copy ... 400 Bad Request
A 400 Bad Request on the blob upload to registry-1.docker.io is an infrastructure flake on Docker Hub's side, not a code or config issue.
@sentry/craft@2.26.11 was live on npm as latest).accepted label to retry only the remaining targets: docker[release], docker[latest], github, gh-pages.All 7 targets for 2.26.11 are now published.
<observations> Date: June 23, 2026 * 🟡 (11:51) User reported publish failed for getsentry/craft@2.26.11 and asked for investigation. * 🟡 (11:52) Publish issue https://github.com/getsentry/publish/issues/8655 had 4 comments, label "ci-ready", state OPEN, title "publish: getsentry/craft@2.26.11". Requested by @BYK. * 🟡 (11:52) Publish run 28022314969 (https://github.com/getsentry/publish/actions…
<observations> Date: June 23, 2026 * 🟡 (11:08) User triggered CI workflow run: https://github.com/getsentry/craft/actions/runs/28021800167 * 🟡 (11:10) CI workflow run completed successfully (EXIT 0) in 19s (ID 82939886394). All steps passed: actions/checkout@v6, actions/setup-node@v6, Get pnpm version from Volta config, pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320, Build Docs, Pac…
<observations> Date: June 23, 2026 * 🔴 (10:03) User switched to new branch 'byk/fix/dependabot-security-alerts' (tracking origin/master) * 🔴 [enforced-workflow] (10:03) User created a dedicated branch before making security fix changes * 🟡 (10:04) package.json (root) read: tar@7.5.11 at line 65, vite not yet present, pnpm.overrides block at lines 103-113 (fast-xml-parser, minimatch, ajv@<6.14.…
<observations> Date: June 23, 2026 * 🟡 (09:41) Full vulnerability analysis completed for getsentry/craft. 5 packages, 12 alerts, 7 distinct fix actions identified. * 🟡 (09:41) tar analysis: Direct devDependency. package.json line 65 pinned at 7.5.11 (no caret/tilde). pnpm-lock.yaml line 6007 resolves tar@7.5.11. Fix: bump line 65 to 7.5.16. Zero breakage risk (patch bump). Confirmed tar@7.5.16 …
Date: June 23, 2026 * 🟡 (09:35) Task list confirmed: 6 fix tasks for 12 Dependabot alerts — tar (#180/#181, medium), form-data (#178/#179, high), vite (#172/#173/#176/#177, high+medium), astro (#174/#175, high+medium), esbuild (#167/#168, low). All tasks status: pending except top-level analysis (in_progress). * 🟡 (09:35) Assistant confirmed 12 open Dependabot alerts across 6 distinct CVEs; beg…
<observations> Date: June 23, 2026 * 🔴 (09:32) User stated they have dependency upgrades to investigate (continuing prior work pattern) * 🟡 (09:35) Security vulnerability scan returned 12 open advisories across pnpm-lock.yaml, package.json, and docs/pnpm-lock.yaml. Details: **tar** (medium, GHSA-vmf3-w455-68vh): * 🟡 Issue #181 — manifest: pnpm-lock.yaml — PAX size override on GNU long-nam…