CedarCopilot wants to merge 3 commits into staging from fix/dependabot-vulns-medium-high-critical
Live on prod since Thu, 1 of 8 behaviors working
Post-deploy production telemetry shows substantial successful mail HTML-processing traffic: gmail.get.output recorded 12,372 executions in worker-service and 2,508 in api-service, with average latency about 230 ms and 1,590 ms respectively (p95 about 444 ms and 2,114 ms). No.
I’m unable to complete the verification because the available telemetry query returned no matching auth spans and the loop ended before the concrete Better Auth routes could be queried or a verdict reported.
Verification reached its 120s wall-clock budget before a tied verdict. Libra is keeping this intent verifying until the next check.
Verification cited only 2 matching post-deploy events, below the 20-event floor for calling a change verified. Nothing is failing; there is not yet enough traffic to confirm it.
Strict CloudWatch fallback found 27 prod failure log lines for [executeExternalCrm] Failed to write snapshot on non-significant sync (Failed query: select \), but the failure is not tied to this intent.
Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.
Libra has verdicts on 1 of 8 tracked behaviors on prod; 7 are still being checked. Libra checks hourly for 3 days after each deploy.
pnpm.overrides, direct dependency bumps in apps/mail, apps/server, apps/desktop, and the better-auth catalog entryelectron-builder 25→26 (fixes app-builder-lib uncontrolled search path + builder-util-runtime token-leak-on-redirect advisories), the @tiptap/* family 3.26→3.31 (ReDoS + prototype-pollution fixes), and @faker-js/faker 9→10 in scripts/ (bun-managed, separate lockfile)better-auth is pinned to ~1.6.33 rather than resolving to the newer 1.7.x line , 1.7.x drops MCP-plugin exports (mcp, withMcpAuth, etc.) that @zero/server depends on; 1.6.33 is well past the advisory's fix version (1.6.22) with the same API surfaceelectron-builder-squirrel-windows, @tiptap/y-tiptap) needed to be added as explicit dependencies rather than relying on pnpm.overrides, since pnpm's peer-auto-install doesn't consistently respect overrides for packages that only ever appear as peer dependencies , without this, a stale vulnerable app-builder-lib@25.1.8 kept getting dragged back into the treeextract-zip (transitive, via the electron-builder chain) has two high-severity symlink-traversal advisories with no patched version published upstream , latest on npm is still 2.0.1. Left as an accepted risk; it's build-time-only (desktop packaging), not shipped to end users.
pnpm install resolves cleanly with no new/unexplained peer-dependency warningspnpm --filter @zero/mail run types , cleanpnpm --filter @zero/server run types , cleanapp-builder-lib, electron-builder-squirrel-windows, builder-util-runtime, @tiptap/y-tiptapelectron-builder dist build (needs notarization credentials unavailable in this environment) , recommend sanity-checking apps/desktop's next real release build given the electron-builder 25→26 major bump🤖 Generated with Claude Code
This PR updates direct and transitive dependencies across the mail, server, desktop, and scripts workspaces to patched releases.
The dependency updates appear safe to merge, with a non-blocking request to exercise the desktop packaging path before relying on electron-builder 26 for a release.
No concrete application, authentication, security, or dependency-resolution failure was established; the remaining concern is that the major desktop packager update is not covered by a non-publishing packaging check despite custom signing and universal-build behavior.
Files Needing Attention: apps/desktop/package.json
| Filename | Overview |
|---|---|
| apps/desktop/package.json | Upgrades Electron tooling across an untested electron-builder major boundary used by a custom signed packaging flow. |
| apps/mail/package.json | Aligns the TipTap family and updates router and sanitizer dependencies with consistent lockfile resolutions. |
| apps/server/package.json | Updates Hono, archive, Markdown, sanitizer, and Vitest dependencies without an established compatibility failure. |
| package.json | Adds and updates security-oriented pnpm overrides; |
Libra has not measured any production surfaces for this change yet.