Repository navigation
CI red on main: npm audit --audit-level=high fails (ws via viem exact pin, langsmith) — fix ready, needs a lockfile push #31
Description
What is broken
Build & Typecheck (Node 20.x) fails on main (and on every rebased dependabot PR, e.g. #21, #22, #23) at the step npm audit --audit-level=high. Reproduced locally on main @ 613135c and on the pre-#14/#19/#20 tree (4311b1c^): the audit was already failing before today's merges — the advisories post-date the last green run, so the red only surfaced when CI re-ran.
High-severity findings on main:
| package | path | advisories | why npm audit fix can't fix it |
|---|---|---|---|
ws 8.18.3 |
agentwallet-sdk 6.2.x → viem 2.46.0 (exact pin) → ws | GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p | viem pins ws: "8.18.3"; agentwallet-sdk pins viem: "2.46.0" |
langsmith 0.5.10 |
@elizaos/core → @langchain/core → langsmith | GHSA-fw9q-39r9-c252, GHSA-rr7j-v2q5-chgv, GHSA-3644-q5cj-c5c7 | needs 0.6.x; only reachable with an override in this tree |
brace-expansion, uuid, @humanfs/node |
transitive | multiple | plain lockfile refresh fixes these |
Verified fix (local: npm ci → npm audit --audit-level=high exit 0 → npm run build exit 0)
Add to package.json:
"overrides": {
"ws": "^8.21.3",
"langsmith": "^0.6.1"
}then npm install (regenerates package-lock.json: ws → 8.21.3 overridden, langsmith → 0.6.3 overridden, agentwallet-sdk → 6.2.1). Both overrides sit inside every dependent's declared range (isows ws *, langsmith ws ^8.19.0, @langchain/core langsmith >=0.5.0 <1.0.0).
Why this issue exists instead of a PR
The automerge session that found this can only write through the GitHub connector's push_files, which requires the file body inline; the regenerated package-lock.json (111 KB) exceeds that path's size limit, and direct git push is not authorized for this repo from that session. The branch automerge/fix-audit-high-2026-09-18 was created for the fix and is still empty (at main). Anyone with a normal git checkout can land this in two minutes:
git checkout -b automerge/fix-audit-high-2026-09-18 main # or reuse the existing empty branch
# add the overrides block above to package.json
npm install && npm audit --audit-level=high && npm run build
git commit -am "fix(ci): resolve high-severity npm audit findings via ws/langsmith overrides" && git pushRoot-cause follow-up (agentwallet-sdk)
agentwallet-sdk pins viem exactly at 2.46.0, so every consumer inherits the vulnerable ws. Relaxing that to ^2.49.4 (or bumping to current viem 2.56.x) and cutting 6.2.2 removes the need for the ws override in every downstream plugin.
Filed by the pr-automerge sweep, 2026-09-18.
Activity