fix: Bump npm deps to clear Dependabot security alerts - #631
Merged
Conversation
Raise Electron/Vite/tar/esbuild in the docs and Electron example so the open Dependabot alerts on this repo close out. All affected packages are dev-only; no runtime library code changes. - examples/electron-app: electron 34 -> 43, electron-vite 2 -> 5, vite 5.4 -> 7.3.6; pin tar override to ^7.5.16 to displace the 6.2.1 transitive that @electron/rebuild / node-gyp / pacote pull in - root docs (vitepress): refresh pnpm-lock so vite lands on 7.3.6 and esbuild on 0.28.1 Clears alerts for electron (< 39.8.5 range), vite (< 7.3.5 range), tar (< 7.5.16 range including the 6.2.x transitive), and esbuild (< 0.28.1 dev-server range).
Contributor
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
xerial
enabled auto-merge (squash)
July 4, 2026 06:48
2 tasks
xerial
added a commit
that referenced
this pull request
Jul 8, 2026
…uilds link (#640) **Description** uni 2026.1.17 broke every downstream Scala Native build on Windows: ``` uni_native0.5_3-2026.1.17-6/scala-native/uni_curl_shim.c:44:10: fatal error: 'dlfcn.h' file not found ``` The `dlsym` rewrite that fixed #622 reached for `<dlfcn.h>` and `<pthread.h>` unconditionally, and MSVC ships neither. Because Scala Native compiles every `.c` under `resources/scala-native/` from every jar on the classpath, this hits consumers that never touch curl — [wvlet's Windows native build](https://github.com/wvlet/wvlet/actions/runs/28837314411) is failing on `main` for exactly this reason, and it only links `wvc-lib`. Both Windows jobs there die on this one error and nothing else. **The fix.** Split the two POSIX primitives per platform, preserving the property #622 turned on — *the object file must reference no libcurl symbol*, or downstream links without `-lcurl` fail: | | POSIX | Windows | |---|---|---| | lookup | `dlsym(RTLD_DEFAULT, name)` | `GetProcAddress` over `EnumProcessModules` | | run-once | `pthread_once` | `InitOnceExecuteOnce` | Windows has no all-modules handle, so the shim enumerates the process's loaded modules and tries each — the process image first, matching `dlsym`'s order. `#define PSAPI_VERSION 2` keeps `EnumProcessModules` in `kernel32` (as `K32EnumProcessModules`) rather than `psapi.lib`, since a jar-resource `.c` can't make downstream binaries add a linker flag. The POSIX path is unchanged in behaviour. One consequence worth flagging: runtime lookup only finds *exported* symbols, so **libcurl must be linked as a DLL**, not a static `.lib`. vcpkg's default `x64-windows` / `arm64-windows` triplets already do that. This isn't new to Windows — a static `libcurl.a` is equally invisible to `dlsym(RTLD_DEFAULT, ...)`. It's the price #622's fix already paid; the ADR and the user docs now say so out loud. **Why CI didn't catch it, and what now does.** Two distinct failure modes, neither check subsuming the other: 1. **`curl shim C (Windows)`** — compiles the shim standalone with clang on `windows-latest`. Nothing else here compiles the Windows half of the `#if`. 2. **`check-curl-shim.sh`** — one step in the Linux Native job, asserting via `nm -u` that the object names no `curl_easy_*` symbol. *No* Scala Native job can catch that on any OS: [`build.sbt` passes `-lcurl` unconditionally](https://github.com/wvlet/uni/blob/main/build.sbt#L101-L103), so uni's own binaries always resolve those symbols and link happily. Only a consumer that doesn't link libcurl breaks — which is precisely how #622 escaped this repo's CI. Inspecting the object stands in for that consumer. I checked (2) bites rather than rubber-stamps: against `v2026.1.16`'s `extern`-based shim it reports `_curl_easy_setopt` / `_curl_easy_getinfo` and exits 1, reproducing #622. Both are gated on a new narrow `native` paths-filter (`**.c`, `**/.native/**`, `project/**`, the workflow itself), so they run on every push to `main` and only on PRs that can actually break them. (`dorny/paths-filter` matches with `dot: true`, so `**/.native/**` does reach the dot-prefixed source trees.) The `changes` filter never watched `**.c` at all before, so an edit touching only this file skipped CI outright. > [!IMPORTANT] > **A real `Scala Native (Windows)` job would be the better guard, and uni cannot run one.** I built it — LLVM, vcpkg libcurl/zlib/OpenSSL, aliasing every `foo.lib` that `-lfoo` asks for — and it compiles everything, then fails at the final link: > > ``` > error LNK2019: unresolved external symbol scalanative_pollin > referenced in function ...wvlet.uni.http.NativeServerTest... > fatal error LNK1120: 5 unresolved externals > ``` > > `NativeServer` uses POSIX `poll()`, and Scala Native's [`posixlib/poll.c`](https://github.com/scala-native/scala-native/blob/v0.5.12/posixlib/src/main/resources/scala-native/poll.c) is wrapped in `#if defined(__unix__) || (defined(__APPLE__) && defined(__MACH__))` — those symbols don't exist on Windows. Every native HTTP test starts a server, so uni's native test binary is unlinkable there, full stop. Giving `NativeServer` a `WSAPoll` path would unblock it; this PR's history has the working toolchain setup to reuse. Worth filing as a follow-up issue. > > That discarded run wasn't wasted: it linked everything *except* `poll`, so none of the unresolved symbols were `curl_easy_*` — proving the shim compiles **and links** clean under clang/MSVC, which is the regression this PR is about. **Docs.** The old text said only *"Scala Native requires libcurl to be available at runtime."* Added [Linking libcurl on Scala Native](https://github.com/wvlet/uni/blob/fix/curl-shim-windows/docs/http/client.md#linking-libcurl-on-scala-native) covering the three things a Native user actually hits: you need libcurl *only* if you use the HTTP client (DCE drops `@link("curl")` otherwise — that's what #622 bought, and nobody would guess it); it must be a shared library; and on Windows you alias `libcurl.lib` to the `curl.lib` Scala Native asks for. **Related Issue/Task** Follow-up to #622 / the ADR added in #631. Unblocks wvlet's `Native` workflow on `main`. **Checklist** - [x] This pull request focuses on a single task. - [x] The change does not contain security credentials 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the open Dependabot security alerts on this repo. Everything touched is dev-only tooling (docs site +
examples/electron-app); no runtime library code changes.examples/electron-appelectron^34.0.0→^43.0.0(electron 34 was well past all the 38/39/40/41-line fixes — 20+ Electron advisories)electron-vite^2.3.0→^5.0.0(5.x is what supports vite 7)vite^5.4.11→^7.3.6(fixes theserver.fs.denybypass,.mappath traversal, and thelaunch-editorNTLMv2 disclosure)pnpm.overridesentry pinningtarto^7.5.16—@electron/rebuild/node-gyp/pacotewere pulling tar6.2.1, which is inside every opentaradvisory rangepnpm-lock.yamlrefresh soviteresolves to7.3.6andesbuildto0.28.1(both are transitive ofvitepress@2.0.0-alpha.17; nothing needed to change inpackage.json)Alerts this covers
Every currently-open alert on https://github.com/wvlet/uni/security/dependabot for
electron,vite,tar, andesbuildacrosspnpm-lock.yaml,examples/electron-app/package.json, andexamples/electron-app/pnpm-lock.yaml.Test plan
pnpm install --frozen-lockfileat repo rootpnpm install --frozen-lockfileinexamples/electron-appelectron@43.0.0,vite@7.3.6,tar@7.5.19,esbuild@0.25.12+0.28.1(electron-app) /vite@7.3.6,esbuild@0.28.1(root docs)