* fix(deps): patch critical Dependabot advisories
Resolve all open critical-severity Dependabot alerts:
- golang.org/x/crypto 0.51.0 -> 0.52.0 (CVE-2026-39830/39831/39832/
39833/39834/42508/46595, GHSA ssh agent/key-constraint bypass, DoS)
- vitest ^1.6.0 -> ^4.1.10 in apps/cli (CVE-2026-47429; aligns with
apps/web, dedupes the lockfile to a single vitest 4.1.10)
- tar ^7.5.11 -> ^7.5.19 in apps/cli (CVE-2026-59873 parse DoS;
resolves to 7.5.21)
Backend builds and vets clean; all 280 apps/cli tests pass on vitest 4.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): bump esbuild to a Vite-8-supported range
The vitest 4 bump pulls vite@8, whose esbuild peer is ^0.27||^0.28,
but the CLI still pinned esbuild ^0.24.0 — pnpm resolved an
unsupported vite/esbuild pair (esbuild@0.24.2) for the CLI test
stack. Bump to ^0.27.0 so vite@8 resolves against esbuild@0.27.2 and
the peer warning clears. CLI tests still pass (280/280).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(release): add repository field for npm provenance
The publish-npm step in release run 25350606233 (v0.39.1) failed for all
6 packages with:
npm error code E422
npm error 422 Unprocessable Entity
Error verifying sigstore provenance bundle: Failed to validate
repository information: package.json: "repository.url" is "",
expected to match "https://github.com/kdlbs/kandev" from provenance
We added `--provenance` to `npm publish` earlier so the registry attaches
a sigstore attestation linking each tarball to its source repo + workflow
run. The attestation is signed using info from the OIDC token (which
includes the repo). At publish time, npm cross-checks the package.json's
`repository.url` against the OIDC repo claim — if the package.json
doesn't have one, or it doesn't match, the publish is rejected.
Both the runtime template (package-npm-runtime.sh) and the main
apps/cli/package.json were missing `repository`. Adding `repository` +
`homepage` to both. The runtime template gets it inline via the
heredoc; the main package.json gets static fields.
This fix unblocks the next release. v0.39.1 itself can't be republished
(version conflict on npm if it had landed; on GitHub release it already
exists). The next release will be v0.39.2 and will go all the way through.
Side state notes:
- v0.39.1 git tag + GitHub release exist with all 5 platform tarballs.
- Homebrew tap was updated to v0.39.1 — `brew install` works as v0.39.1.
- npm has nothing at v0.39.1 (all 6 publishes 422'd).
- v0.39.2 will replace the npm side; Homebrew formula will move forward;
v0.39.1 GitHub release stays as a historical artifact.
* fix(release): re-chmod cli.js after artifact download (lost in zip roundtrip)
`brew install kdlbs/kandev/kandev` followed by `kandev` failed with:
/opt/homebrew/bin/kandev: line 2:
/opt/homebrew/Cellar/kandev/0.39.1/libexec/cli/bin/cli.js: Permission denied
cannot execute: Undefined error: 0
Inspected the published v0.39.1 macos-arm64 tarball:
-rwxr-xr-x kandev/bin/kandev (755 — executable, correct)
-rwxr-xr-x kandev/bin/agentctl (755 — executable, correct)
-rw-r--r-- kandev/cli/bin/cli.js (644 — NOT executable)
Root cause: `actions/upload-artifact@v4` + `actions/download-artifact@v4`
zip-encode the artifact during upload and extract during download.
**Executable bits do not survive that round-trip.** The Go binaries
(kandev, agentctl) keep their +x because they're built inside the same
build-bundles job (no artifact crossing); cli.js is built in build-cli,
uploaded as an artifact, downloaded in build-bundles, and emerges as 644.
The chmod +x in package-cli.sh runs before upload, so it's effectively
erased.
Fix: re-apply chmod +x to dist/kandev/cli/bin/cli.js right before
tarballing, in the Package bundle step (which runs in build-bundles
after the artifact download).
Could not have been caught by the Tier 1.1 local smoke test we did
before merging — that test cp -R'd the cli/ dir directly without an
artifact roundtrip, so the chmod survived. This bug only manifests in
CI's matrix builds.
Manual recovery for v0.39.1 brew users:
chmod +x /opt/homebrew/Cellar/kandev/0.39.1/libexec/cli/bin/cli.js
Or wait for v0.39.2 and `brew upgrade kandev`.
github-actions[bot]