mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
3e3a7ef72d
# Description Bumps the `packageManager` pin from `pnpm@10.28.0` to `pnpm@10.28.2`, the smallest release that fixes [**CVE-2026-24056**](https://nvd.nist.gov/vuln/detail/CVE-2026-24056) — a symlink attack in pnpm where installing a malicious `file:` (directory) or `git:` dependency that contains a symlink to an absolute path causes pnpm to copy that target file's contents (e.g. `~/.ssh/id_rsa`, `/etc/passwd`) into `node_modules`, enabling local data exfiltration on developer machines and CI runners. Practical risk for this repo is **LOW** — we only install registry-pinned dependencies with `minimumReleaseAge: 4320` (72-hour cooldown) configured in `pnpm-workspace.yaml`, so the attacker would need a malicious package to (a) be added as a dependency, and (b) sit unnoticed for 72h. The fix is nevertheless a one-line defensive bump that aligns this repo with the rest of the monorepo: | repo | pnpm version | status | |--------------------|-------------|--------| | hermes | `10.33.0` | safe | | composio_dashboard | `10.28.2` | safe | | frontend | `10.28.2` | safe | | **composio (this PR)** | `10.28.0` -> `10.28.2` | **fix** | | metrics.composio.io | `10.18.2` | flagged separately (no CI) | Discovered during the daily Zen security audit cron. # How did I test this PR - Diff is a single character bump (`10.28.0` -> `10.28.2`) in `package.json` `packageManager`. No code, lockfile, or workflow changes — `pnpm install` will simply use the newer pnpm via Corepack. - Verified `composio_dashboard` and `frontend` already pin `pnpm@10.28.2` successfully across their CI workflows. - No GHA file modified, so the pnpm-version reference in `ts/docs/internal/release.md` (per `CLAUDE.md` maintenance task) does not need to be updated by this PR. --- Triggered by: dhawal@composio.dev | Source: cron-48e51eab745f Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729 Origin: cron-48e51eab745f / [zen-cron-16acec0fd729](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729)
92 lines
3.6 KiB
JSON
92 lines
3.6 KiB
JSON
{
|
|
"name": "composio",
|
|
"version": "0.10.0-alpha.1",
|
|
"private": true,
|
|
"description": "",
|
|
"workspaces": [
|
|
"ts/packages/core",
|
|
"ts/packages/json-schema-to-zod",
|
|
"ts/packages/cli",
|
|
"ts/packages/cli-keyring",
|
|
"ts/packages/cli-local-tools",
|
|
"ts/packages/providers/*"
|
|
],
|
|
"scripts": {
|
|
"build": "turbo build",
|
|
"build:binary": "turbo build:binary --filter=./ts/packages/cli",
|
|
"build:binary:all": "turbo build:binary:all --filter=./ts/packages/cli",
|
|
"build:binary:checksums": "turbo build:binary:checksums --filter=./ts/packages/cli",
|
|
"install:binary": "turbo install:binary --filter=./ts/packages/cli",
|
|
"build:packages": "turbo build --filter=./ts/packages/**",
|
|
"cli:record": "turbo run record --filter=./ts/packages/cli",
|
|
"record": "turbo run record",
|
|
"test": "turbo test --filter=./ts/packages/** --filter=!@e2e-tests/* && pnpm run test:examples",
|
|
"test:examples": "tsx ts/scripts/validate-examples.ts",
|
|
"test:e2e": "turbo test:e2e --filter='@e2e-tests/*'",
|
|
"test:e2e:node": "turbo test:e2e:node --filter='@e2e-tests/node-*'",
|
|
"test:e2e:deno": "turbo test:e2e:deno --filter='@e2e-tests/deno-*'",
|
|
"test:e2e:cli": "turbo test:e2e:cli --filter='@e2e-tests/cli-*'",
|
|
"test:e2e:cloudflare": "turbo test:e2e:cloudflare --filter='@e2e-tests/cf-*'",
|
|
"test:ui": "vitest --ui",
|
|
"typecheck": "turbo typecheck --filter=./ts/packages/**",
|
|
"typecheck:tsc": "turbo typecheck:tsc --filter=./ts/packages/**",
|
|
"lint": "eslint ts/packages --ext .ts,.tsx",
|
|
"lint:packages": "eslint ts/packages --ext .ts,.tsx",
|
|
"lint:fix": "eslint . --ext .ts,.tsx --fix",
|
|
"lint:fix:packages": "eslint ts/packages --ext .ts,.tsx --fix",
|
|
"format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,md}\"",
|
|
"preinstall": "./ts/scripts/pre-install.sh",
|
|
"prepare": "husky",
|
|
"create:provider": "bash ts/scripts/create-provider.sh",
|
|
"create:example": "bash ts/scripts/create-example.sh",
|
|
"check:peer-deps": "tsx ts/scripts/check-peer-deps.ts",
|
|
"update:peer-deps": "tsx ts/scripts/update-peer-deps.ts",
|
|
"prepublish": "pnpm run build:packages",
|
|
"changeset": "changeset",
|
|
"changeset:version": "changeset version",
|
|
"changeset:release": "pnpm run build:packages && changeset publish",
|
|
"changeset:pre-enter": "changeset pre enter",
|
|
"changeset:pre-exit": "changeset pre exit",
|
|
"clean": "git clean -xdf .turbo node_modules ts/packages/**/.turbo ts/packages/**/node_modules ts/packages/**/dist",
|
|
"clean:workspace": "pnpm turbo clean"
|
|
},
|
|
"packageManager": "pnpm@10.28.2",
|
|
"devDependencies": {
|
|
"@arethetypeswrong/cli": "catalog:",
|
|
"@changesets/cli": "^2.29.8",
|
|
"@composio/anthropic": "workspace:*",
|
|
"@composio/cli-local-tools": "workspace:*",
|
|
"@composio/core": "workspace:*",
|
|
"@composio/openai": "workspace:*",
|
|
"@types/bun": "^1.3.6",
|
|
"@types/node": "^22.15.18",
|
|
"@typescript/native-preview": "catalog:",
|
|
"@vitest/ui": "^3.1.4",
|
|
"eslint": "^9.25.1",
|
|
"globals": "^16.0.0",
|
|
"husky": "^9.1.7",
|
|
"lint-staged": "^15.5.1",
|
|
"prettier": "^3.5.3",
|
|
"publint": "catalog:",
|
|
"semver": "^7.7.2",
|
|
"tsdown": "catalog:",
|
|
"tsx": "catalog:",
|
|
"turbo": "^2.8.11",
|
|
"typescript-eslint": "^8.31.0",
|
|
"vitest": "catalog:",
|
|
"zod": "catalog:"
|
|
},
|
|
"lint-staged": {
|
|
"ts/packages/**/*.{ts,tsx}": [
|
|
"eslint --fix"
|
|
],
|
|
"ts/packages/**/*.{ts,tsx,js,jsx,json,md}": [
|
|
"prettier --write"
|
|
],
|
|
"python/**/*.py": [
|
|
"ruff check --fix --config python/config/ruff.toml",
|
|
"ruff format --config python/config/ruff.toml"
|
|
]
|
|
}
|
|
}
|