From 934a8657fd1fb8722b76ee162faff91b174c6a2f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 08:31:25 +0000 Subject: [PATCH 1/3] chore(deps): bump brace-expansion from 5.0.9 to 5.0.12 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.9 to 5.0.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.9...v5.0.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index aa35d9dae2..b3743acf99 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7334,9 +7334,9 @@ "optional": true }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" From 89f884de0dcc76c3959de4ae693cc6c629c94807 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 08:31:46 +0000 Subject: [PATCH 2/3] chore(deps): bump fast-uri from 3.1.7 to 3.1.8 Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 3.1.8. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index b3743acf99..20799e7419 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9884,9 +9884,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "funding": [ { "type": "github", From 07eaa3aa306de43028f61dec264baf7572232161 Mon Sep 17 00:00:00 2001 From: liugddx Date: Thu, 1 Oct 2026 19:35:12 +0800 Subject: [PATCH 3/3] fix(deps): clear shipped-closure advisories and refresh notices The shipped-dependency audit fails on main because advisories now reach the product closure: - brace-expansion@5.0.9 (high) - fast-uri@3.1.7 (moderate) - axios@1.18.1 (high, several advisories fixed in 1.20.0) The two Dependabot bumps (#5881, #5882) each fix only one advisory, so each still fails the audit on the other one. Neither regenerates the third-party notices, so `check:release` also rejects them. Take both bumps, move the transitive axios to 1.20.0 within its existing `^1.x` ranges (used by @larksuiteoapi/node-sdk and @wecom/aibot-node-sdk), and regenerate the desktop and CLI third-party notices with the pinned npm (11.19.0). Co-Authored-By: Claude Opus 5.5 (1M context) --- .../resources/licenses/npm/THIRD_PARTY_NOTICES.txt | 6 +++--- package-lock.json | 8 ++++---- packages/cli/THIRD_PARTY_NOTICES.txt | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt index e501be4de3..33501a5bc5 100644 --- a/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt +++ b/apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt @@ -6191,7 +6191,7 @@ SOFTWARE. ================================================================================ -Package: axios@1.18.1 +Package: axios@1.20.0 Declared license: MIT Selected license: MIT Repository: https://github.com/axios/axios.git @@ -6891,7 +6891,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ================================================================================ -Package: brace-expansion@5.0.9 +Package: brace-expansion@5.0.12 Declared license: MIT Selected license: MIT Repository: git+https://github.com/juliangruber/brace-expansion.git @@ -9882,7 +9882,7 @@ SOFTWARE. ================================================================================ -Package: fast-uri@3.1.7 +Package: fast-uri@3.1.8 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: git+https://github.com/fastify/fast-uri.git diff --git a/package-lock.json b/package-lock.json index 20799e7419..f9b0c49065 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7132,13 +7132,13 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.18.1", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", - "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", + "version": "1.20.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", + "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", - "form-data": "^4.0.5", + "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" } diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt index 8b091f92b3..7055a7f54a 100644 --- a/packages/cli/THIRD_PARTY_NOTICES.txt +++ b/packages/cli/THIRD_PARTY_NOTICES.txt @@ -2304,7 +2304,7 @@ SOFTWARE. ================================================================================ -Package: axios@1.18.1 +Package: axios@1.20.0 Declared license: MIT Selected license: MIT Repository: https://github.com/axios/axios.git @@ -3004,7 +3004,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. ================================================================================ -Package: brace-expansion@5.0.9 +Package: brace-expansion@5.0.12 Declared license: MIT Selected license: MIT Repository: git+https://github.com/juliangruber/brace-expansion.git @@ -3970,7 +3970,7 @@ SOFTWARE. ================================================================================ -Package: fast-uri@3.1.7 +Package: fast-uri@3.1.8 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: git+https://github.com/fastify/fast-uri.git