chore: update @cursor/sdk to 1.0.26 and override undici - #32
Open
serrade wants to merge 1 commit into
Open
Conversation
The 1.0.13 dependency tree carried 19 advisories, including the only critical one. Newer SDK releases drop the native sqlite3 dependency, which removes the tar, node-gyp, cacache, make-fetch-happen and brace-expansion chains along with it. An undici override clears the remaining advisory in that package. npm audit goes from 19 advisories (1 critical, 14 high) to 8 (7 high). The rest predate this change and come from the Cloudflare and Vite toolchain, so they are out of scope here. Typecheck and the Worker test suite pass unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The dependency tree on
maincarries 19 advisories, including the only critical one:Most of them arrive through
@cursor/sdk@1.0.13, which depends on the nativesqlite3package and pulls intar(critical),node-gyp,cacache,make-fetch-happenandbrace-expansion.Fix
@cursor/sdk^1.0.13to^1.0.26. Newer releases no longer require native SQLite, so that whole chain disappears.undicioverride at^8.9.0, which clears the remaining advisory in that package.After:
The 8 that remain predate this change and come from the Cloudflare and Vite toolchain (
vite,wrangler,miniflare,sharp,postcss,ws,@cloudflare/vite-plugin). They are untouched by the SDK bump and out of scope here.Verification
npm ci,npm run typecheck,npm testall pass; Package macOS smoke green on my fork.npm auditon this branch andnpm audit --package-lock-onlyagainstmainfor the baseline.The bridge continues to work against the newer SDK; no source changes were needed.