Conversation
ec760aa to
83081db
Compare
There was a problem hiding this comment.
Code Review
This pull request updates multiple lockfiles across the repository, bumping versions for a wide range of dependencies. Critical security feedback indicates that several of the updated versions—including @types/node@25.5.2, lodash@4.18.1, and esbuild@0.27.7—do not exist on the public npm registry, signaling a potential supply chain attack or dependency confusion attempt. Furthermore, an inconsistency was identified in the transitivePeerDependencies for @google/genai@1.48.0, which is missing utf-8-validate despite its inclusion in the resolution key.
|
|
||
| '@types/node@25.5.0': | ||
| resolution: {integrity: sha512-jp2P3tQMSxWugkCUKLRPVUpGaL5MVFwF8RDuSRztfwgN1wmqJeMSbKlnEtQqU8UrhTmzEmZdu2I6v2dpp7XIxw==} | ||
| '@types/node@25.5.2': |
There was a problem hiding this comment.
| lodash@4.17.23: | ||
| resolution: {integrity: sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==} | ||
|
|
||
| lodash@4.18.1: |
There was a problem hiding this comment.
CRITICAL SECURITY WARNING: The version 4.18.1 for lodash does not exist on the public npm registry (the latest stable version is 4.17.21). This pattern of non-existent, highly-bumped versions is seen throughout this PR (e.g., @types/node@25.5.2, @google/genai@1.48.0, esbuild@0.27.7). This is a strong indicator of a supply chain attack, such as dependency confusion or malicious package injection. Do not merge this PR until the legitimacy of these versions and the source registry have been thoroughly verified. Additionally, lodash@4.17.23 remains in the lock file, which suggests a failure in deduplication.
| - utf-8-validate | ||
|
|
||
| '@google/genai@1.48.0(@modelcontextprotocol/sdk@1.28.0(supports-color@10.2.2))(bufferutil@4.1.0)(supports-color@10.2.2)(utf-8-validate@6.0.6)': | ||
| '@google/genai@1.48.0(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2))(bufferutil@4.1.0)(supports-color@10.2.2)(utf-8-validate@6.0.6)': |
83081db to
9011144
Compare
See associated pull request for more information.
9011144 to
fc55af2
Compare
This PR contains the following updates:
🔧 This Pull Request updates lock files to use the latest dependency versions.