Repository navigation
fix(dependencies): Update Autter-dev/autter-tracker - #1
Draft
autter-dev[bot] wants to merge 2 commits into
Draft
autter-dev[bot] wants to merge 2 commits into
autter-dev[bot] wants to merge 2 commits into
Conversation
![autter[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Automated vendor API adaptation for vendor change rup_1934fdd01ba0_2026-10-30. Bumped the runtime security-sensitive dependencies to their fixed versions and updated the lockfile surgically: better-auth 1.5.6 -> 1.6.11, @better-auth/passkey 1.5.6 -> 1.6.11, hono 4.12.10 -> 4.12.25, drizzle-orm 0.44.7 -> 0.45.2, zod 4.3.6 -> 4.6.6, kysely 0.28.15 -> 0.28.17, source-map-js 1.2.1 -> 1.2.2. The @better-auth/* subtree (core 1.6.11, utils 0.4.0, better-call 1.3.5, adapters 1.6.11) was updated in the lockfile so the tree stays consistent. Verified: `npm ci --include=dev` installs cleanly, `tsc --noEmit` passes for both packages, and the full CLI vitest suite (61 tests, including the new repro test) passes. Added reproduction test packages/cli/tests/dependency-versions.test.ts asserting the fixed resolved versions (fails before, passes after). Deviations (need human review): @better-auth/passkey was bumped to 1.6.11 instead of the listed 1.4.0 because 1.4.0 fails the API typecheck against better-auth@1.6.11 (its peers require better-auth@1.4.0); pg was left at ^8.14.0 (the listed 2.11.2 is a legacy downgrade conflicting with better-auth's pg ^8 peer and is unused); wrangler left at ^4.0.0 (listed 2.20.1 is a downgrade incompatible with wrangler.toml); vitest/vite left at 3.x/7.x (dev-only; 4.x rewrites the whole dev tree). Transitive-only advisories (tinypool, sharp, brace-expansion, js-yaml, undici, ws, @vitest/mocker) were not individually pinnable because their parents do not allow the listed fixed versions (or the package is no longer in the tree). Note: plain `npm install` hits ERESOLVE due to upstream peer constraints; the validated install path is `npm ci` (or --legacy-peer-deps). Autter-Fix-Job: rup_1934fdd01ba0_2026-10-30
autter-dev
Bot
added
the
autter-fix: proposal
Automated vendor API adaptation for vendor change rup_1934fdd01ba0_2026-11-01. Fixed GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch) by bumping the transitive versions resolved under test-exclude in package-lock.json: glob 10.5.0 -> 14.0.2 and minimatch 9.0.9 -> 11.0.1, with the required transitive lockfile updates (path-scurry 3.0.0, lru-cache 11.1.0, brace-expansion 5.0.12, @isaacs/nonrecursive-glob-match). No direct source call sites or dependency manifests exist for glob/minimatch (grep across the repo found only transitive lockfile ranges), so the change is lockfile-only plus a guard test. Added packages/cli/tests/dependency-versions.test.ts asserting the fixed versions resolve; the CLI test suite (62 tests, incl. this guard) passes with the change, and the guard fails against the pre-fix lockfile (glob 10.5.0 / minimatch 9.0.9). Note: the repository's .git directory is root-owned and not writable by this sandbox user, so the change could not be committed with git; it is staged only as working-tree modifications on branch autter/fix-updates. Autter-Fix-Job: rup_1934fdd01ba0_2026-11-01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft adaptation for a third-party vendor API change detected by Autter.
Vendor change
dependencies(production)CVEs added in this project
14.0.211.0.1Why this repo is hit
Scheduled repository update for vendor API changes and known CVEs.
What this PR changes
Fixed GHSA-3g3m-2fjr-6pw4 (glob) and GHSA-g3hv-75wg-m249 (minimatch) by bumping the transitive versions resolved under test-exclude in package-lock.json: glob 10.5.0 -> 14.0.2 and minimatch 9.0.9 -> 11.0.1, with the required transitive lockfile updates (path-scurry 3.0.0, lru-cache 11.1.0, brace-expansion 5.0.12, @isaacs/nonrecursive-glob-match). No direct source call sites or dependency manifests exist for glob/minimatch (grep across the repo found only transitive lockfile ranges), so the change is lockfile-only plus a guard test. Added packages/cli/tests/dependency-versions.test.ts asserting the fixed versions resolve; the CLI test suite (62 tests, incl. this guard) passes with the change, and the guard fails against the pre-fix lockfile (glob 10.5.0 / minimatch 9.0.9). Note: the repository's .git directory is root-owned and not writable by this sandbox user, so the change could not be committed with git; it is staged only as working-tree modifications on branch autter/fix-updates.
Remediation safety and rollback
Actual changed files:
package-lock.json,packages/cli/tests/dependency-versions.test.tscode fix: Apply every listed update in one change on branch autter/fix-updates. Do not open a separate pull request. Do not add packages that are not already dependencies. You may edit the lockfile only for: glob, minimatch.
Blast radius (unknown): The available analysis has not established the impact on shared callers, users, or data. Prepare the draft automatically; a human must assess these before merge or production rollout.
The actual draft also changes 1 file(s) outside the assessed scope: package-lock.json. Their downstream impact is unknown and requires human rollout review.
Affected: package-lock.json, packages/cli/tests/dependency-versions.test.ts, dependencies
Rollback strategy: Before merge, close the draft PR and discard its branch. If deployed later, revert the fix commit through a reviewed PR and redeploy the previous compatible release. Confirm data/schema compatibility before reverting and verify recovery using the original failure signal.
If this draft is abandoned, close the PR. If deployed later, revert the complete patch, including the additional files, through a reviewed PR; check data/schema compatibility and verify the original failure signal recovers.
Validation required:
Verification
Fix tier: Proposal only. adversarial review failed with the fix.
Reproduction (
packages/cli/tests/dependency-versions.test.ts, run with(cd packages/cli && npx vitest run 'tests/dependency-versions.test.ts')):npm run typecheck)npm run typecheck)npm run lint)./commands/statsimport should occur before import of./commands/statusimport/order /tmp/autter-agentic-yxu57l/repo/packages/cli/src/commands/login.ts 23:18 error This assertion is unnecessary since it does not change the type ofnpm run lint)./commands/statsimport should occur before import of./commands/statusimport/order /tmp/autter-agentic-yxu57l/repo/packages/cli/src/commands/login.ts 23:18 error This assertion is unnecessary since it does not change the type ofnpm run build)npm run test)These results come from Autter's runner, not from the fixer's own report.
Keeps
packages/cli/tests/dependency-versions.test.tsin this PR: it fails without this change and passes with it.Opened as a draft by Autter. Deprecated packages, breaking API changes, newer API versions, and CVE bumps for this repository land together on
autter/fix-updates. The next day adds a commit to this pull request. Review carefully before merging.