chore: update dependencies (2026-07-31) by isamu · Pull Request #194 · receptron/MulmoChat

isamu · 2026-07-30T22:54:38Z

Summary

Periodic dependency maintenance for MulmoChat (aggressive yarn upgrade --latest, dedupe, yarn audit, plus a small CI hardening). Baseline typecheck / lint / build were green before and remain green after. 1 repo = 1 PR.

Verification (all green after the update): yarn typecheck (vue-tsc), yarn lint (eslint src server), yarn build (vite + tsc server), prettier --check, yarn install --frozen-lockfile, yarn audit (0 vulnerabilities).

Items to Confirm / Review

@anthropic-ai/sdk 0.74 → 0.115 is a large jump across many 0.x releases. typecheck/build pass (server is pure TS via tsc), but no server integration test runs in CI (the test:* scripts all need live API keys), so please sanity-check the Anthropic text/tool path at runtime.
concurrently 9 → 10 (major). Dev-only (yarn dev); not exercised by CI. Please confirm local dev still launches.
brace-expansion security resolution (^5.0.8) added to force the transitive copy pulled via @gui-chat-plugin/mulmocast → mulmocast → @google-cloud/text-to-speech → google-gax → … → minimatch up from 2.1.4 to 5.0.9 (CVE-2025-5889 DoS). expand() API is stable across majors and this path is build/TTS tooling only, but it is a global override — confirm mulmocast TTS still works. Root fix belongs upstream in google-gax/mulmocast.
GitHub Dependabot reports 4 vulnerabilities on the default branch (1 critical, 1 high, 2 moderate). yarn audit on this branch is now clean (0), so the remaining Dependabot alerts are in areas its DB flags but yarn audit does not — worth a look on the Security tab; they were not addressable via a direct/transitive version bump in this pass.
CI matrix kept at ubuntu + windows + macos (node 22.x, 24.x). MulmoChat is not published so ubuntu-only would suffice, but the merged ci/add-mac-win-runners branch shows the cross-platform matrix is intentional, so it was left as-is.

Dependencies updated

Runtime:

@anthropic-ai/sdk ^0.74.0 → ^0.115.0 (major-ish within 0.x)
@google/genai ^2.1.0 → ^2.15.0
exa-js ^2.1.1 → ^2.16.3
vue ^3.5.34 → ^3.5.40
vue-router ^5.0.6 → ^5.2.0
yauzl ^3.2.1 → ^3.4.0

Dev:

concurrently ^9.2.1 → ^10.0.4 (major)
eslint ^10.7.0 → ^10.8.0
globals ^17.7.0 → ^17.8.0
postcss ^8.5.21 → ^8.5.25
@types/node ^26.1.1 → ^26.1.2
vite ^8.1.5 → ^8.2.0
vue-tsc ^3.3.7 → ^3.3.8

resolutions: tar 7.5.18 → 7.5.22, yauzl → ^3.4.0, added brace-expansion ^5.0.8.

Held back (with reason)

typescript held at ^6.0.3 (latest is 7.0.2). TS7 breaks ts-node@10, and typescript-eslint@8 supports typescript <6.1.0. 6.0.3 is the max published 6.x, so the eslint peer stays satisfied.
github exotic deps (@gui-chat-plugin/piano, guichat-plugin-akinator) — pinned to git refs, not on the semver track; untouched.
typescript-eslint (8.65.0) and @eslint/js (10.0.1) were already at latest; @eslint/js major (10) matches eslint major (10).

Housekeeping notes

yarn upgrade --latest spuriously promoted tar into dependencies (yarn v1 quirk from the existing resolutions pin); removed it since tar is not imported directly — it stays a resolution-only pin.
No committed merge-conflict markers were present (only ==== markdown separators in docs, which are not conflicts).
openai is not a direct dependency (realtime uses a direct fetch to api.openai.com), so the "hold openai v5+" guidance did not apply.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Improved CI security by preventing checkout credentials from persisting after workflow runs.
- Updated underlying application and development tooling components for improved compatibility and maintenance.
User Impact
- No new end-user features or interface changes were introduced.

Aggressive dependency refresh + security + CI hardening. - deps: @anthropic-ai/sdk 0.74→0.115, @google/genai→2.15, exa-js→2.16.3, vue→3.5.40, vue-router→5.2.0, yauzl→3.4.0 - devDeps: concurrently 9→10, eslint→10.8.0, globals→17.8.0, postcss→8.5.25, @types/node→26.1.2, vite→8.2.0, vue-tsc→3.3.8 - hold: typescript pinned ^6.0.3 (TS7 breaks ts-node@10; typescript-eslint@8 supports typescript <6.1.0) - security: resolutions brace-expansion ^5.0.8 (CVE-2025-5889 DoS, transitive via mulmocast→google-gax→minimatch); tar→7.5.22. yarn audit now clean. - ci: add persist-credentials: false to checkout Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-30T22:54:54Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0897c253-a70f-4032-96f9-34190a824956

📥 Commits

Reviewing files that changed from the base of the PR and between 354319c and a967d23.

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

.github/workflows/pull_request.yaml
package.json

📝 Walkthrough

Walkthrough

The pull request updates runtime and development dependency ranges, aligns package resolutions, and disables persisted checkout credentials in the pull request GitHub Actions workflow.

Changes

Dependency updates

Layer / File(s)	Summary
Runtime and toolchain version updates `package.json`	Runtime dependencies, package resolutions, and development tooling dependencies are updated to newer version ranges.

CI checkout configuration

Layer / File(s)	Summary
Checkout credential persistence `.github/workflows/pull_request.yaml`	The repository checkout step sets `persist-credentials` to `false`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

receptron/MulmoChat#193: Updates overlapping dependency version ranges in package.json.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: a dependency update chore.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/deps-update-20260731

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-30T22:55:52Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@anthropic-ai/sdk@0.74.0 ⏵ 0.115.0	^-17	^-8	⁺¹
postcss@8.5.21 ⏵ 8.5.25	⁺¹		⁺¹
@types/node@26.1.1 ⏵ 26.1.2
vite@8.1.5 ⏵ 8.2.0	⁺¹	⁺¹
globals@17.7.0 ⏵ 17.8.0	⁺¹	⁺¹	⁺⁵
yauzl@3.3.0 ⏵ 3.4.0	⁺¹		^-3
vue@3.5.34 ⏵ 3.5.40	⁺¹		^-1
vue-router@5.0.6 ⏵ 5.2.0		^-1
vue-tsc@3.3.7 ⏵ 3.3.8			^-1
concurrently@9.2.4 ⏵ 10.0.4	⁺¹		⁺¹
@google/genai@1.50.0 ⏵ 2.15.0	^-3
eslint@10.7.0 ⏵ 10.8.0			^-1
exa-js@2.16.0 ⏵ 2.16.3	⁺¹

View full report

socket-security · 2026-07-30T22:55:54Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: yarn.lock → `npm/@gui-chat-plugin/mulmocast@1.1.0` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

isamu merged commit 0e52441 into main Jul 30, 2026
12 checks passed

isamu deleted the chore/deps-update-20260731 branch July 30, 2026 23:02

Navigation Menu

Uh oh!

chore: update dependencies (2026-07-31) - #194

chore: update dependencies (2026-07-31)#194
isamu merged 1 commit into
mainfrom
chore/deps-update-20260731

isamu commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 30, 2026

Uh oh!

socket-security Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

isamu commented Jul 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Items to Confirm / Review

Dependencies updated

Held back (with reason)

Housekeeping notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

socket-security Bot commented Jul 30, 2026

Uh oh!

socket-security Bot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

isamu commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading