@checkstack/gitops-backend 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +43 -0
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,48 @@
|
|
|
1
1
|
# @checkstack/gitops-backend
|
|
2
2
|
|
|
3
|
+
## 0.3.4
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [a06b899]
|
|
8
|
+
- Updated dependencies [a06b899]
|
|
9
|
+
- @checkstack/backend-api@0.16.0
|
|
10
|
+
- @checkstack/command-backend@0.1.28
|
|
11
|
+
- @checkstack/queue-api@0.3.3
|
|
12
|
+
|
|
13
|
+
## 0.3.3
|
|
14
|
+
|
|
15
|
+
### Patch Changes
|
|
16
|
+
|
|
17
|
+
- b33fb4d: Refresh `bun.lock` to clear MEDIUM-severity Trivy advisories on transitive
|
|
18
|
+
runtime dependencies. No public API change — bumping every workspace
|
|
19
|
+
package that lists `@orpc/server` as a direct dep so consumers re-resolve
|
|
20
|
+
the optional `ws` peer to the patched release on their next install.
|
|
21
|
+
|
|
22
|
+
- `ws` `8.20.0` → `8.20.1` (CVE-2026-45736). Pulled into the install tree
|
|
23
|
+
as `@orpc/server`'s optional WebSocket peer; Bun auto-installs it into
|
|
24
|
+
every backend package that depends on `@orpc/server`, so a stale 8.20.0
|
|
25
|
+
ships in the consumer's `node_modules` until the parent package
|
|
26
|
+
re-resolves.
|
|
27
|
+
- `brace-expansion` `5.0.5` → `5.0.6` (CVE-2026-45149). Pulled in only
|
|
28
|
+
through dev tooling (`minimatch@10` via `@typescript-eslint` and
|
|
29
|
+
`storybook`'s `glob@13`), so it does not ship to consumers and no
|
|
30
|
+
workspace `package.json` lists it; the lockfile bump alone clears the
|
|
31
|
+
finding for the Docker image and the local dev tree. No version bump
|
|
32
|
+
is attributed to this advisory.
|
|
33
|
+
|
|
34
|
+
The fix lives entirely in `bun.lock` — no `package.json`, `overrides`, or
|
|
35
|
+
`resolutions` change is needed because both parent ranges (`minimatch@10
|
|
36
|
+
→ brace-expansion@^5.0.5`, `@orpc/server / storybook / happy-dom →
|
|
37
|
+
ws@>=8.18.x`) already accept the patched releases, and `bun install`
|
|
38
|
+
keeps the resolved versions sticky after the initial `bun update`.
|
|
39
|
+
|
|
40
|
+
- Updated dependencies [1909a61]
|
|
41
|
+
- Updated dependencies [b33fb4d]
|
|
42
|
+
- @checkstack/backend-api@0.15.3
|
|
43
|
+
- @checkstack/command-backend@0.1.27
|
|
44
|
+
- @checkstack/queue-api@0.3.2
|
|
45
|
+
|
|
3
46
|
## 0.3.2
|
|
4
47
|
|
|
5
48
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@checkstack/gitops-backend",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.4",
|
|
4
4
|
"license": "Elastic-2.0",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.ts",
|
|
@@ -14,11 +14,11 @@
|
|
|
14
14
|
"lint:code": "eslint . --max-warnings 0"
|
|
15
15
|
},
|
|
16
16
|
"dependencies": {
|
|
17
|
-
"@checkstack/backend-api": "0.15.
|
|
17
|
+
"@checkstack/backend-api": "0.15.3",
|
|
18
18
|
"@checkstack/gitops-common": "0.4.0",
|
|
19
19
|
"@checkstack/common": "0.10.0",
|
|
20
|
-
"@checkstack/command-backend": "0.1.
|
|
21
|
-
"@checkstack/queue-api": "0.3.
|
|
20
|
+
"@checkstack/command-backend": "0.1.27",
|
|
21
|
+
"@checkstack/queue-api": "0.3.2",
|
|
22
22
|
"@orpc/server": "^1.13.2",
|
|
23
23
|
"drizzle-orm": "^0.45.0",
|
|
24
24
|
"minimatch": "^10.0.0",
|