#38 cannot be made green from this side. No @sveltejs/kit release
accepts TypeScript 7: 2.70.3, the current latest, peers
`^5.3.3 || ^6.0.0`, and even the 3.0.0-next.27 prerelease peers
`^6.0.0`. svelte-check caps at 6 as well. `npm ci` stops on ERESOLVE
before a line is compiled, so there is nothing to fix here -- the block
is upstream.
Left open, Dependabot reopens it every week for as long as that stays
true. So the major is ignored for typescript in /web only, with the
condition for removing it written next to it. Minor and patch updates
still come through, and every other package is untouched.
GHSA-2v4p-qf9q-27wj is a panic in gRPC-Go's xDS routing interceptor: a
request arriving with neither `:authority` nor `Host` indexes an empty
slice, the per-RPC goroutine does not recover, and the process dies.
High, and nine alerts, because nine go.mod files pin the same version --
eight directly, terraform indirectly.
Nothing here was reachable. The interceptor is installed by
`xds.NewGRPCServer`, which this repo never calls: the one production
server is `grpc.NewServer(grpc.Creds(...))` in ingest/internal/grpcserver
and the only other is a plain one in a searchclient test. That is also
why security-scan has been green throughout -- govulncheck reports on
reachability and found nothing on 1.83.1, while Dependabot reports on
version ranges and found nine. Both were right.
Taken anyway: it is a patch release, and the next advisory in this
dependency may well land somewhere we do reach.
`go mod tidy` carried the indirect requirements grpc 1.83.2 asks for --
x/net, x/text, x/sys and friends. No CI job builds or tests Go here, so
all nine modules were built locally and api, ingest and enterprise
tested with -count=1, since a cached pass would not have exercised the
new version.
The dependabot.yml is the other half. There was no config, so nothing
opened a PR against any of this. Go majors stay out of the group, being
import path changes rather than bumps.
jcoffey-dev