run-llama / llama-agents / 42178149807
85%

DEFAULT BRANCH: main
Ran
Jobs 12
Files 235
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.173% (+0.005%) from 85.168%
42178149807

push

github

web-flow 
Update pnpm to v10.34.5 [SECURITY] (#876)

> [!NOTE]
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
|
[`10.11.1+sha512.e519b9f76a006d7317d6bfa1ee87c667912`
→ `10.34.5`](https://renovatebot.com/diffs/npm/pnpm/10.11.1/10.34.5) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/10.34.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/10.11.1/10.34.5?slim=true)
|

---

### pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by
default"
[CVE-2025-69264](https://nvd.nist.gov/vuln/detail/CVE-2025-69264) /
[GHSA-379q-355j-w6rj](https://redirect.github.com/advisories/GHSA-379q-355j-w6rj)

<details>
<summary>More information</summary>

#### Details
##### pnpm v10+ Git Dependency Script Execution Bypass

##### Summary

A security bypass vulnerability in pnpm v10+ allows git-hosted
dependencies to execute arbitrary code during `pnpm install`,
circumventing the v10 security feature "Dependency lifecycle scripts
execution disabled by default". While pnpm v10 blocks `postinstall`
scripts via the `onlyBuiltDependencies` mechanism, git dependencies can
still execute `prepare`, `prepublish`, and `prepack` scripts during the
fetch phase, enabling remote code execution without user consent or
approval.

##### Details

pnpm v10 introduced a security feature to disable dependency lifecycle
scripts by default ([PR
#&#8203;8897](https://redirect.github.com/pnpm/pnpm/pull/8897)). This is
implemented by setting `onlyBuiltDependencies = []` when no build policy
is configured:

**File:** `pkg-manager/core/src/install/extendIn... (continued)

18962 of 22263 relevant lines covered (85.17%)

1.15 hits per line

Coverage Regressions

Lines Coverage ∆ File
1
64.23
-0.14% packages/llama-agents-control-plane/src/llama_agents/control_plane/k8s_client.py
Jobs
ID Job ID Ran Files Coverage
1 llama-agents-core - 42178149807.1 15
81.34
GitHub Action Run
2 llama-agents-client - 42178149807.2 4
95.32
GitHub Action Run
3 llama-agents-appserver - 42178149807.3 17
81.96
GitHub Action Run
4 llama-agents-dbos - 42178149807.4 11
75.72
GitHub Action Run
5 llamactl - 42178149807.5 48
79.79
GitHub Action Run
6 llama-agents-integration-tests - 42178149807.6 102
64.97
GitHub Action Run
7 llama-agents-server - 42178149807.7 31
86.15
GitHub Action Run
8 llama-agents-control-plane - 42178149807.8 31
74.57
GitHub Action Run
9 llama-index-utils-workflow - 42178149807.9 1
70.84
GitHub Action Run
10 llama-agents-agentcore - 42178149807.10 5
70.22
GitHub Action Run
11 llama-agents-dev - 42178149807.11 12
76.5
GitHub Action Run
12 llama-index-workflows - 42178149807.12 53
94.18
GitHub Action Run
Source Files on build 42178149807