stacklok / toolhive-studio

68%

main: 70%

LAST BUILD ON BRANCH worktree-fix-cve-audit-overrides

branch: worktree-fix-cve-audit-overrides

CHANGE BRANCH

x

Reset

• worktree-fix-cve-audit-overrides
• 0.26.0
• HEAD
• add-adp
• add-bearer-token-check
• add-e2e-documentaio
• add-linux-dev-script
• add-skill-about-deep-links
• add-some-skills
• ai-bump
• ai-models
• arm-improvements
• avoid-thv-desktop-check
• azure-siging-pre-release
• azure-signin
• banner-mcp-optimizer
• batch-stop
• bin-handle
• build-bump-configure-aws-credentials
• build-error
• build-fix-arch
• build-flatpak-pacakge
• build-test
• build-test-chek-write-permission
• build-test-semver-version
• bump-ai-deps
• bump-hono-ovveride-version
• bump-json-schema-faker
• bump-streamdown-2
• bump-streamdown-mermaid
• bump-tanstack-router
• bump-thv-v0.12.0
• bump-ui-deps
• chat-thread
• chore/add-claude-agents-md
• chore/migrate-trivy-to-grype
• chore/remove-agents-feature-flag
• chore/renovate-minimum-release-age
• chore/tone-down-sentry-replay
• chore/update-toolhive-0.19.0
• chore/upgrade-e2e-ollama-model
• chunk-ipc-main-handler
• chunk-main-events
• ci-prerelease-validation
• ci/skip-macos-signing-on-pr-builds
• clean-pre-commit
• clean-up-end-to-end-tets
• cleanup-even-more-stuff
• cleanup/redundant-overrides-v2
• cli-validation-copy-update
• common-folder
• configurable-app-info
• contribai/fix/security/unsafe-ipc-handler-accepts-unknown-type-
• coveralls-dedupe-status
• coveralls-fix
• create-skills-about-tests
• create-update-button-override
• customize-colors-in-desktop-app
• danbarr/sort-clients-alphabetically
• danbarr/strip-registry-name-prefix
• db-sentry
• deep-link-skills
• default-size-pagination
• disable-ssentry-by-env
• do-not-show-confirmation-native-end-to-end
• docs/refresh-readme-diagrams
• dussab-patch-1
• edit-wording
• experiment/bug-fix-visual
• feat/agent-feat-workflow
• feat/azure-artifact-signing-release-oidc
• feat/chat-cost
• feat/help-menu-config
• feat/hide-experimental-enterprise
• feat/playground-copy-message
• feat/playground-edit-resend-message
• feat/playground-per-agent-claim
• feat/playground-queue-while-streaming
• feat/proxy_fields
• feat/registry-tab-read-only
• feat/show-hide-custom-mcp-by-permission
• feat/tdd-bug-fix-agent
• feat/visual-bug-fix-agent
• fine-tuning-onramp
• fix-brace-expansion
• fix-bundle-id
• fix-cli-bash-path
• fix-config-types
• fix-copy-log
• fix-e2e
• fix-flaky-theme-provider-test
• fix-grype-vulns
• fix-hono
• fix-hono-vuln
• fix-lodash
• fix-mcp-sdk-vuln
• fix-mirrod-gh-pages
• fix-mirror-gh-pages
• fix-mirror-gh-pages-win
• fix-newsletter-help-menu
• fix-picomatch
• fix-playground
• fix-pnpm-audit
• fix-registry-promo
• fix-renovate-install
• fix-renovate-post-ugprade
• fix-renovate-post-upgrade-gh-action
• fix-restart
• fix-routing-warning
• fix-rpm-build
• fix-security-agente-schedule
• fix-settings-e2e
• fix-shell-macos
• fix-skill-git
• fix-symlink-missing
• fix-toolhive-version-check
• fix-tooltip
• fix-type-errors
• fix-undici-vuln
• fix-unit-test-coverage
• fix-unused-export
• fix-validation
• fix-version-install
• fix-vuln-hono
• fix-vulns
• fix-warning-router
• fix-windows-latest
• fix-windows-window-controls
• fix-workflow
• fix-xml-parser
• fix/action-renovate
• fix/agent-persist-draft-thread
• fix/auto-1402
• fix/auto-2069
• fix/auto-2103
• fix/bug-fix-npm-install-claude
• fix/bug-fix-use-github-token-for-comments
• fix/bug-fix-workflow-permissions
• fix/ci-workflow-permissions
• fix/cli-feature-flag
• fix/deps-audit
• fix/google-playground-models
• fix/ipc-workload-validation
• fix/npm-install-claude-code
• fix/openapi-ts-postprocess
• fix/playground-large-tool-results
• fix/playground-thread-rehydrate
• fix/pr-build-workflow-checkout
• fix/registry-skill-install-reference
• fix/validate-release-tag-format
• fix/version-tab-download-permission
• fix/windows-auto-update-checksum
• flatpak-fix
• fn-registry-card
• fn-skills-page
• folder-path-paste
• github-app-renovate-post
• ignore-worktree
• implement-deep-link-poc
• improve-upgrade
• input-save-draft
• install-button
• issues/1339
• issues/1430
• issues/1439
• issues/1461
• issues/1484
• issues/1530
• issues/1533
• issues/1553
• issues/1659
• issues/1672
• issues/1708
• issues/1760
• issues/1876
• issues/1923
• issues/1977
• issues/258
• linux-arm
• local-build-detail
• main
• mcp-app-playground
• modernize-ollama-config
• more-app-info
• more-cleanup
• more-refactor
• more-test-refactor
• move-sentry-flag
• multi-thread
• navbar-redesign
• navbar-redesign-2
• new-clients
• newsletter-manual
• newsletter-modal
• onramp-utm-tags
• override-avj
• override-express-rate-limit
• override-rebuild
• pagination-registry-skill
• pagination-space
• pass-instance-id
• playground-agents
• playground-persist-mcp-app
• playground-refactor-loading
• playground-routing
• playground-streaming-persistant
• pnpm-11-upgrade
• polling-shared-state
• pre-release
• prefill-version
• preload-refactoring
• publisher-s3
• quit-dialog
• refactor-auth-type-remote
• refactor-general-tabs
• refactor-more-tests
• refactor/global-test-mocks
• refactor/security-agent-claude-code-action
• refactor/settings-tabs-alias-import
• registry-custom-upsell
• registry-fine-tuning
• release-s3
• remove-backfill
• remove-electron-store
• remove-flag
• remove-flag-skills
• remove-mcp-optimizer
• remove-migration-dialog-quit
• remove-override
• remove-sh
• renovate-change
• renovate/actions-cache-digest
• renovate/actions-checkout-digest
• renovate/actions-create-github-app-token-3.x
• renovate/actions-create-github-app-token-digest
• renovate/actions-github-script-9.x
• renovate/actions-setup-node-digest
• renovate/actions-upload-artifact-digest
• renovate/ai-5.x-lockfile
• renovate/ai-6.x
• renovate/ai-6.x-lockfile
• renovate/ai-sdk-anthropic-2.x-lockfile
• renovate/ai-sdk-anthropic-3.x
• renovate/ai-sdk-anthropic-3.x-lockfile
• renovate/ai-sdk-google-3.x
• renovate/ai-sdk-google-3.x-lockfile
• renovate/ai-sdk-mcp-1.x
• renovate/ai-sdk-mcp-1.x-lockfile
• renovate/ai-sdk-ollama-3.x-lockfile
• renovate/ai-sdk-openai-3.x
• renovate/ai-sdk-openai-3.x-lockfile
• renovate/ai-sdk-openai-compatible-1.x-lockfile
• renovate/ai-sdk-openai-compatible-2.x
• renovate/ai-sdk-openai-compatible-2.x-lockfile
• renovate/ai-sdk-provider-3.x
• renovate/ai-sdk-provider-3.x-lockfile
• renovate/ai-sdk-react-2.x-lockfile
• renovate/ai-sdk-react-3.x
• renovate/ai-sdk-react-3.x-lockfile
• renovate/ai-sdk-xai-2.x-lockfile
• renovate/ai-sdk-xai-3.x
• renovate/ai-sdk-xai-3.x-lockfile
• renovate/anchore-scan-action-7.x
• renovate/anthropics-claude-code-action-digest
• renovate/aquasecurity-trivy-action-0.x
• renovate/autoprefixer-10.x
• renovate/autoprefixer-10.x-lockfile
• renovate/aws-actions-configure-aws-credentials-digest
• renovate/azure-login-3.x
• renovate/better-sqlite3-12.x
• renovate/better-sqlite3-12.x-lockfile
• renovate/brace-expansion-1.1.13-1.x
• renovate/defu-6.x
• renovate/docker-setup-buildx-action-4.x
• renovate/docker-setup-buildx-action-digest
• renovate/dotenv-17.x
• renovate/dotenv-17.x-lockfile
• renovate/electron-40.x
• renovate/electron-41.x
• renovate/electron-forge-monorepo
• renovate/electron-fuses-2.x
• renovate/electron-fuses-2.x-lockfile
• renovate/electron-log-5.x
• renovate/electron-rebuild-4.x
• renovate/eslint-monorepo
• renovate/eslint-plugin-react-refresh-0.x
• renovate/fast-xml-parser-5.x
• renovate/ghcr.io-stackloklabs-mcp-optimizer-0.x
• renovate/globals-17.x
• renovate/globals-17.x-lockfile
• renovate/hey-api-openapi-ts-0.x
• renovate/hono-node-server-1.x
• renovate/jsdom-29.x
• renovate/json-schema-faker-0.x
• renovate/knip-5.x-lockfile
• renovate/knip-6.x
• renovate/lint-staged-16.x
• renovate/lint-staged-16.x-lockfile
• renovate/lucide-monorepo
• renovate/major-github-artifact-actions
• renovate/memfs-4.x
• renovate/memfs-4.x-lockfile
• renovate/modelcontextprotocol-ext-apps-1.x
• renovate/modelcontextprotocol-sdk-1.x
• renovate/modelcontextprotocol-sdk-1.x-lockfile
• renovate/msw-2.x
• renovate/msw-2.x-lockfile
• renovate/nanoid-5.x
• renovate/nanoid-5.x-lockfile
• renovate/node-24.x
• renovate/node-24.x-lockfile
• renovate/openrouter-ai-sdk-provider-2.x
• renovate/openrouter-ai-sdk-provider-2.x-lockfile
• renovate/path-to-regexp-=8.0.0-8.4.0-8.x
• renovate/playwright-monorepo
• renovate/pnpm-10.x
• renovate/pnpm-action-setup-5.x
• renovate/pnpm-action-setup-6.x
• renovate/pnpm-action-setup-digest
• renovate/prettier-3.x
• renovate/prettier-plugin-classnames-0.x
• renovate/prettier-plugin-merge-0.x
• renovate/prettier-plugin-merge-0.x-lockfile
• renovate/prettier-plugin-tailwindcss-0.x
• renovate/radix-ui-primitives-monorepo
• renovate/react-hook-form-7.x
• renovate/react-monorepo
• renovate/rimraf-6.x
• renovate/rimraf-6.x-lockfile
• renovate/sentry-electron-7.x
• renovate/sentry-electron-7.x-lockfile
• renovate/sentry-vite-plugin-4.x-lockfile
• renovate/sentry-vite-plugin-5.x
• renovate/serialize-javascript-7.x
• renovate/sonner-2.x
• renovate/stacklok-toolhive-0.x
• renovate/streamdown-1.x-lockfile
• renovate/streamdown-2.x
• renovate/streamdown-2.x-lockfile
• renovate/streamdown-cjk-1.x-lockfile
• renovate/streamdown-code-1.x-lockfile
• renovate/streamdown-mermaid-1.x-lockfile
• renovate/tailwind-merge-3.x
• renovate/tailwind-merge-3.x-lockfile
• renovate/tailwindcss-monorepo
• renovate/tanstack-query-monorepo
• renovate/tanstack-router-monorepo
• renovate/tar-7.x
• renovate/tar-7.x-lockfile
• renovate/testing-library-monorepo
• renovate/tmp-0.x
• renovate/tw-animate-css-1.x
• renovate/typescript-6.x
• renovate/typescript-eslint-monorepo
• renovate/update-electron-app-3.x
• renovate/vite-8.x
• renovate/vitejs-plugin-react-6.x
• renovate/vitejs-plugin-react-swc-4.x
• renovate/vitejs-plugin-react-swc-4.x-lockfile
• renovate/vitest-fail-on-console-0.x
• renovate/vitest-monorepo
• renovate/zod-4.x
• rerender-refactoring
• revert-windows-arm64
• s3-auto-update
• s3-folder-structure
• s3-update
• s3-update-pre-release
• save-remote-edit
• security-fix-agent
• security/auto-remediate-vulns
• security/auto-remediate-vulns-manual
• sentry-thv
• sentry-thv-env
• settings-per-thread
• show-latest-version-info
• skill-detail-fetch
• skill-install-clients
• skill-registry-metadata
• skill-tester
• skills-es-search
• skills-experimental-false
• skills-generic-fn
• skills-get-builds
• skills-multi-clients
• skills-poc
• skills-registry
• skills-registry-table
• specific-404-page-registry
• sql-flag-experimental-false
• sqlite-poc
• sticky-font
• straight-to-config-deep-link
• suppress-sentry-in-end-to-end
• table-view
• table-view-registries
• tailwind-config
• talk-to-expert
• telemetry-skills
• test-console
• test-ollama-e2e
• test-playground-1
• test-tool-calls-e2e
• thv-v0.7.2
• tool-call-testing-attempt-s
• tooltip-registry
• tooltip-skill
• track-mcp-app
• track-threads
• tracking-update
• typescript-v6
• ugprade-ai-sdk
• unix-socket
• unused-export
• update-from-registry
• update-model-claude
• update-test-setup
• upgrade-electron
• upgrade-enterprise-navbar
• use-exec
• use-fixed-ollama-version
• use-pnpm-lint-staged
• use-temp-user-data-dir
• use-test-wrappers-1
• use-test-wrappers-2
• use-workload-status
• v0.16.0
• v0.17.0
• v0.17.1
• v0.17.1-rc
• v0.17.1-rc.1
• v0.17.2
• v0.17.3
• v0.18.0
• v0.18.0-rc.1
• v0.18.1
• v0.18.1-rc.1
• v0.19.0
• v0.19.0-rc.0
• v0.19.0-rc.1
• v0.19.0-rc.2
• v0.19.1
• v0.20.0
• v0.20.0-rc.0
• v0.21.0
• v0.22.0
• v0.22.0-rc.0
• v0.22.0-rc.1
• v0.22.0-rc.2
• v0.22.1-rc.0
• v0.23.0
• v0.24.0
• v0.25.0
• v0.25.0-rc.0
• v0.26.0
• v0.26.0-rc.0
• v0.27.0
• v0.27.0-rc.0
• v0.27.1
• v0.28.0
• v0.28.0-rc.0
• v0.28.1
• v0.29.0
• v0.30.0
• v0.30.0-rc.0
• v0.31.0
• v0.31.0-rc.0
• v0.32.0
• v0.32.0-rc.0
• v0.32.0-rc.1
• v0.32.1
• v0.32.1-rc.0
• v0.33.0
• v0.33.0-rc.0
• v0.33.1
• v0.33.1-rc.0
• v0.34.0
• v0.34.0-rc.0
• v0.34.0-rc.1
• v0.35.0
• v0.35.0-rc.0
• v0.35.0-rc.1
• v0.35.0-rc.2
• v8-upgrade
• virtual-thread
• windows-arm
• worktree-issue-2210-error-boundaries
• worktree-issue-2228-registry-legacy-format
• worktree-thv-serve-keeps-running-on-kill-desktop-app

Build # 25722380061

Build Type

Pull #2218

github

Committed by peppescg

Commit Message

fix(security): ignore @tanstack/history malware advisory (false positive on 1.161.6)

Follow-up to the previous commit. Drop the pnpm.overrides pin for
@tanstack/history; the malicious 1.161.9 / 1.161.12 releases have
already been unpublished from npm, and the lockfile resolves to the
clean 1.161.6.

The advisory keeps an open-ended `>=0` range, so `pnpm audit` keeps
failing CI with a false positive against 1.161.6. Add
`pnpm.auditConfig.ignoreGhsas: [GHSA-rmmr-r34h-pfm5]` so the audit
step in `_security-checks.yml` passes without masking real findings.

Also revert the @tanstack/history entry from `.grype.yaml` since
nothing is being pinned for it anymore.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #2218: fix(security): override mermaid >=11.15.0 and ignore @tanstack/history false positive

Coverage Stats

4712 of 7478 branches covered (63.01%)

7033 of 10349 relevant lines covered (67.96%)

120.52 hits per line