ci: replace release-please with Nx release by legreffier[bot] · Pull Request #1534 · getlarge/themoltnet

legreffier · 2026-06-30T15:21:08Z

Summary

Closes #1482

replace the release-please fanout workflow with an Nx release workflow scoped from version plans
remove release-please manifest/config and the release-please CLI recovery workflow
let the Go CLI artifact publisher create/upload/finalize the GitHub Release used for CLI artifacts
update contributor release notes and stale release-please docs

Validation

pnpm run check:actionlint
pnpm exec vitest run src/release/go-version-actions.test.ts src/release/go-artifact-publisher.test.ts (from tools/)
pnpm exec nx typecheck @moltnet/tools
temporary CLI version-plan dry-run: pnpm exec nx release --groups cli --dry-run --verbose --skip-publish
moltnet-cli:nx-release-publish --dryRun=true

github-actions · 2026-06-30T15:22:04Z

🚨 Dependency Audit — Vulnerabilities found

Full report

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Incomplete fix for CVE-2023-48223: JWT       │
│                     │ Algorithm Confusion via Whitespace-Prefixed RSA Public │
│                     │ Key                                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mvf2-f6gm-w987      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: Cache Confusion via cacheKeyBuilder          │
│                     │ Collisions Can Return Claims From a Different Token    │
│                     │ (Identity/Authorization Mixup)                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=0.0.1 <6.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-rp9m-7r4c-75qg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ Arbitrary code execution in protobufjs                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.0.1                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-xq3m-2v4x-88gg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ critical            │ fast-jwt: JWT auth bypass due to empty HMAC secret     │
│                     │ accepted by async key resolver                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.2.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-gmvf-9v4p-v8jc      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-jwt accepts unknown `crit` header extensions (RFC │
│                     │ 7515 violation)                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.1.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm7r-c7qw-ghp6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code injection through bytes field        │
│                     │ defaults in generated toObject code                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-66ff-xgx4-vchm      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Code generation gadget after prototype    │
│                     │ pollution                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-75px-5xx7-5xc7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Process-wide denial of service through    │
│                     │ unsafe option paths                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jvwf-75h9-cwgg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobuf.js: Denial of service through unbounded       │
│                     │ protobuf recursion                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-685m-2w69-288q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ protobufjs: Denial of service through unbounded Any    │
│                     │ expansion during JSON conversion                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.4.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.4.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-wcpc-wj8m-hjx6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to TLS certificate validation bypass │
│                     │ via dropped requestTls in SOCKS5 ProxyAgent            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vmh5-mc38-953g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to TLS certificate validation bypass │
│                     │ via dropped requestTls in SOCKS5 ProxyAgent            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.23.0 <7.28.0                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vmh5-mc38-953g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via cumulative fragment bypass                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-38rv-x7px-6hhq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via fragment count bypass                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vxpw-j846-p89q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici WebSocket client vulnerable to denial of        │
│                     │ service via fragment count bypass                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vxpw-j846-p89q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ undici vulnerable to cross-origin request routing via  │
│                     │ SOCKS5 proxy pool reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.23.0 <7.28.0                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-hm92-r4w5-c3mj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt has a ReDoS when using RegExp in allowed*     │
│                     │ leading to CPU exhaustion during token verification    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=5.0.0 <=6.2.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-cjw9-ghj4-fwxf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ fast-jwt: Stateful RegExp (/g or /y) causes            │
│                     │ non-deterministic allowed-claim validation (logical    │
│                     │ DoS)                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-jwt                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <6.2.1                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=6.2.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>@fastify/       │
│                     │ jwt>fast-jwt                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-3j8v-cgw4-2g6q      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ ip-address has XSS in Address6 HTML-emitting methods   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ ip-address                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=10.1.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=10.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-host>@modelcontextprotocol/sdk>express-rate- │
│                     │ limit>ip-address                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v2v4-37r5-5v8g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Denial of service from crafted field      │
│                     │ names in generated code                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2pr8-phx7-x9h3      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobuf.js: Prototype injection in generated message  │
│                     │ constructors                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-fx83-v9x8-x52w      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs has overlong UTF-8 decoding                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.0.1                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.0.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-q6x5-8v7m-xcrf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs: Denial of Service via unbounded recursive  │
│                     │ JSON descriptor expansion                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.2.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.2.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-jggg-4jg4-v7c6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ uuid: Missing buffer bounds check in v3/v5/v6 when buf │
│                     │ is provided                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ uuid                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <11.1.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=11.1.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__mcp-server>@getlarge/fastify-mcp>mqemitter-      │
│                     │ redis>hyperid>uuid                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-w5hq-g745-h8pq      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ protobufjs : Schema-derived names can shadow           │
│                     │ runtime-significant properties                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ protobufjs                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <=8.5.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.6.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/otlp-transformer>protobufjs       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f38q-mgvj-vph7      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ OpenTelemetry Core: Unbounded memory allocation in W3C │
│                     │ Baggage propagation                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @opentelemetry/core                                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <2.8.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=2.8.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@opentelemetry/exporter-trace-otlp- │
│                     │ proto>@opentelemetry/core                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-8988-4f7v-96qf      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to HTTP header injection via         │
│                     │ Set-Cookie percent-decoding                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p88m-4jfj-68fv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to HTTP header injection via         │
│                     │ Set-Cookie percent-decoding                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-p88m-4jfj-68fv      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to cross-user information disclosure │
│                     │ via shared cache whitespace bypass                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pr7r-676h-xcf6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ undici vulnerable to cross-user information disclosure │
│                     │ via shared cache whitespace bypass                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pr7r-676h-xcf6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ Elliptic Uses a Cryptographic Primitive with a Risky   │
│                     │ Implementation                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ elliptic                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=6.6.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ <0.0.0                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ libs__auth>get-jwks>jwk-to-pem>elliptic                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-848j-6mx2-7j84      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to HTTP response queue poisoning via │
│                     │ keep-alive socket reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-35p6-xmwp-9g52      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to HTTP response queue poisoning via │
│                     │ keep-alive socket reuse                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-35p6-xmwp-9g52      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to Set-Cookie SameSite attribute     │
│                     │ downgrade via permissive substring matching            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=8.0.0 <8.5.0                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.0                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ apps__agent-daemon>@earendil-works/gondolin>undici     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-g8m3-5g58-fq7m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ undici vulnerable to Set-Cookie SameSite attribute     │
│                     │ downgrade via permissive substring matching            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=7.0.0 <7.28.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.28.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ tools>undici                                           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-g8m3-5g58-fq7m      │
└─────────────────────┴────────────────────────────────────────────────────────┘
35 vulnerabilities found
Severity: 5 low | 14 moderate | 12 high | 4 critical

github-actions · 2026-06-30T15:22:24Z

⚠️ Knip — Unused code or dependencies found

Run pnpm run knip locally to see details, or pnpm run knip:fix to auto-fix some of them.

Full report

�[93m�[4mUnused files�[24m�[39m (45)
.agents/skills/monitor-ci/scripts/ci-poll-decide.mjs                                       
.agents/skills/monitor-ci/scripts/ci-state-update.mjs                                      
apps/agent-daemon/src/lib/sandbox.ts                                                       
apps/console-e2e/src/seed-diary-browser.ts                                                 
apps/landing/src/hooks/useFeedSSE.ts                                                       
apps/mcp-host/server.mjs                                                                   
apps/mcp-host/src/sandbox.ts                                                               
apps/mcp-server-e2e/src/seed-task-app.ts                                                   
apps/mcp-server/src/schemas/index.ts                                                       
apps/rest-api/src/migrate.ts                                                               
apps/rest-api/src/sse/public-feed-poller.ts                                                
apps/rest-api/src/sse/sse-writer.ts                                                        
apps/rest-api/src/typebox-schema-id.d.ts                                                   
docs/.vitepress/env.d.ts                                                                   
evals/moltnet-practices/auth-middleware-early-return/fixtures/auth-plugin.ts               
evals/moltnet-practices/auth-middleware-early-return/fixtures/team-resolver.ts             
evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/sdk.gen.ts                    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/consolidate-workflow.ts    
evals/moltnet-practices/repository-tenant-scope-bypass/fixtures/diary-entry.repository.ts  
evals/moltnet-practices/rest-error-boundary/fixtures/pack-routes.ts                        
evals/moltnet-practices/rest-error-boundary/fixtures/verification-routes.ts                
evals/moltnet-practices/webhook-auth-status-code/fixtures/hooks.ts                         
examples/diary-create.ts                                                                   
examples/diary-search.ts                                                                   
examples/register.ts                                                                       
examples/sign-entry.ts                                                                     
libs/task-ui/demo/App.tsx                                                                  
libs/task-ui/demo/main.tsx                                                                 
test-fixtures/generate-ssh-vectors.mjs                                                     
test-fixtures/generate-x25519-vectors.mjs                                                  
tools/db/backfill-content-hashes.ts                                                        
tools/db/backfill-diary-team-links.ts                                                      
tools/db/backfill-keto-subject-set.ts                                                      
tools/db/backfill-personal-teams.ts                                                        
tools/db/backfill-team-relations-plural.ts                                                 
tools/db/cleanup-legacy-diary-tuples.ts                                                    
tools/docker-build.mjs                                                                     
tools/generators/split-tsconfigs/index.ts                                                  
tools/generators/split-tsconfigs/schema.d.ts                                               
tools/release/docker-preversion.mjs                                                        
tools/src/release/github-action-publisher.ts                                               
tools/src/release/go-module-publisher.cli.ts                                               
tools/src/tasks/api.ts                                                                     
tools/src/tasks/scenario.ts                                                                
tools/src/tasks/seed-judge-fixture.ts                                                      
�[93m�[4mUnused dependencies�[24m�[39m (58)
@moltnet/observability                       apps/agent-daemon-e2e/package.json:8:6     
@moltnet/tasks                               apps/agent-daemon-e2e/package.json:9:6     
@earendil-works/gondolin                     apps/agent-daemon/package.json:92:6        
@opentelemetry/instrumentation               apps/agent-daemon/package.json:97:6        
@opentelemetry/instrumentation-dns           apps/agent-daemon/package.json:98:6        
@opentelemetry/instrumentation-http          apps/agent-daemon/package.json:99:6        
@opentelemetry/instrumentation-net           apps/agent-daemon/package.json:100:6       
@opentelemetry/instrumentation-pg            apps/agent-daemon/package.json:101:6       
@opentelemetry/instrumentation-pino          apps/agent-daemon/package.json:102:6       
@opentelemetry/instrumentation-undici        apps/agent-daemon/package.json:103:6       
pino-pretty                                  apps/agent-daemon/package.json:112:6       
@moltnet/models                              apps/console/package.json:11:6             
@moltnet/bootstrap                           apps/mcp-server-e2e/package.json:8:6       
@moltnet/database                            apps/mcp-server-e2e/package.json:10:6      
@moltnet/crypto-service                      apps/mcp-server/package.json:29:6          
@moltnet/entry-explore-mcp-app               apps/mcp-server/package.json:30:6          
@themoltnet/design-system                    apps/mcp-server/package.json:34:6          
@fastify/otel                                apps/mcp-server/package.json:36:6          
@opentelemetry/exporter-metrics-otlp-proto   apps/mcp-server/package.json:38:6          
@opentelemetry/exporter-trace-otlp-proto     apps/mcp-server/package.json:39:6          
@opentelemetry/instrumentation               apps/mcp-server/package.json:40:6          
@opentelemetry/instrumentation-dns           apps/mcp-server/package.json:41:6          
@opentelemetry/instrumentation-http          apps/mcp-server/package.json:42:6          
@opentelemetry/instrumentation-net           apps/mcp-server/package.json:43:6          
@opentelemetry/instrumentation-pino          apps/mcp-server/package.json:44:6          
@opentelemetry/instrumentation-pg            apps/mcp-server/package.json:45:6          
@opentelemetry/instrumentation-runtime-node  apps/mcp-server/package.json:46:6          
@opentelemetry/instrumentation-undici        apps/mcp-server/package.json:47:6          
@opentelemetry/resources                     apps/mcp-server/package.json:48:6          
@opentelemetry/sdk-metrics                   apps/mcp-server/package.json:49:6          
@opentelemetry/sdk-trace-base                apps/mcp-server/package.json:50:6          
@opentelemetry/sdk-trace-node                apps/mcp-server/package.json:51:6          
@opentelemetry/semantic-conventions          apps/mcp-server/package.json:52:6          
pino                                         apps/mcp-server/package.json:56:6          
pino-opentelemetry-transport                 apps/mcp-server/package.json:57:6          
thread-stream                                apps/mcp-server/package.json:58:6          
@huggingface/transformers                    apps/rest-api/package.json:33:6            
@opentelemetry/exporter-metrics-otlp-proto   apps/rest-api/package.json:53:6            
@opentelemetry/instrumentation               apps/rest-api/package.json:55:6            
@opentelemetry/resources                     apps/rest-api/package.json:63:6            
@opentelemetry/sdk-metrics                   apps/rest-api/package.json:64:6            
@opentelemetry/sdk-trace-base                apps/rest-api/package.json:65:6            
@opentelemetry/sdk-trace-node                apps/rest-api/package.json:66:6            
@opentelemetry/semantic-conventions          apps/rest-api/package.json:67:6            
multiformats                                 apps/rest-api/package.json:74:6            
pino-pretty                                  apps/rest-api/package.json:77:6            
thread-stream                                apps/rest-api/package.json:78:6            
@noble/hashes                                libs/context-pack-service/package.json:19:6
typebox                                      libs/sdk/package.json:44:6                 
tslib                                        package.json:149:6                         
@earendil-works/pi-ai                        tools/package.json:22:6                    
@earendil-works/pi-coding-agent              tools/package.json:23:6                    
@moltnet/auth                                tools/package.json:25:6                    
@moltnet/models                              tools/package.json:32:6                    
@themoltnet/agent-runtime                    tools/package.json:36:6                    
@themoltnet/pi-extension                     tools/package.json:38:6                    
drizzle-orm                                  tools/package.json:41:6                    
fastq                                        tools/package.json:42:6                    
�[93m�[4mUnused devDependencies�[24m�[39m (31)
@moltnet/bootstrap          apps/agent-daemon/package.json:115:6        
@moltnet/crypto-service     apps/agent-daemon/package.json:116:6        
@moltnet/bootstrap          apps/console/package.json:21:6              
@moltnet/crypto-service     apps/console/package.json:22:6              
@moltnet/database           apps/console/package.json:23:6              
@themoltnet/sdk             apps/console/package.json:24:6              
@playwright/test            apps/console/package.json:26:6              
@moltnet/bootstrap          apps/mcp-server/package.json:61:6           
@moltnet/database           apps/mcp-server/package.json:62:6           
@moltnet/mcp-test-harness   apps/mcp-server/package.json:63:6           
@modelcontextprotocol/sdk   apps/mcp-server/package.json:64:6           
drizzle-orm                 apps/mcp-server/package.json:65:6           
pino-pretty                 apps/mcp-server/package.json:66:6           
@moltnet/api-client         apps/rest-api/package.json:84:6             
@moltnet/bootstrap          apps/rest-api/package.json:85:6             
vitest                      libs/bootstrap/package.json:24:6            
@moltnet/crypto-service     libs/context-distill/package.json:17:6      
@moltnet/database           libs/context-distill/package.json:18:6      
@testcontainers/postgresql  libs/context-distill/package.json:19:6      
drizzle-orm                 libs/context-distill/package.json:20:6      
pg                          libs/context-distill/package.json:21:6      
@types/pg                   libs/context-distill/package.json:22:6      
testcontainers              libs/diary-service/package.json:29:6        
@testing-library/react      libs/entry-explore-mcp-app/package.json:30:6
vitest                      libs/mcp-test-harness/package.json:22:6     
@nx/devkit                  package.json:74:6                           
@swc/helpers                package.json:86:6                           
husky                       package.json:96:6                           
lint-staged                 package.json:101:6                          
vite-plugin-dts             package.json:109:6                          
@types/figlet               tools/package.json:51:6                     
�[93m�[4mReferenced optional peerDependencies�[24m�[39m (1)
ink  libs/design-system/package.json
�[93m�[4mUnlisted dependencies�[24m�[39m (2)
@moltnet/database  evals/moltnet-practices/e2e-raw-fetch-vs-api-client/fixtures/governance.e2e.test.ts:19:46
pg                 libs/diary-service/__tests__/diary-service.dbos.integration.test.ts:38:27                
�[93m�[4mUnlisted binaries�[24m�[39m (6)
python3                                             .github/workflows/ci.yml
gofmt                                               .lintstagedrc.mjs       
go                                                  package.json            
gofmt                                               package.json            
packages/openclaw-skill/scripts/publish-clawhub.sh  package.json            
packages/openclaw-skill/scripts/package.sh          package.json            
�[93m�[4mUnused exports�[24m�[39m (115)
COMMON_REQUIRED_FLAGS                                       apps/agent-daemon/src/lib/help.ts:3:14                      
COMMON_OPTIONAL_FLAGS                                       apps/agent-daemon/src/lib/help.ts:11:14                     
getDaemonRuntimeContext                           function  apps/agent-daemon/src/lib/runtime-context.ts:24:17          
buildDaemonSlotId                                 function  apps/agent-daemon/src/lib/task-execution-plan.ts:97:17      
ENTRY_TYPE_LABELS                                           apps/console/src/diaries/utils.ts:14:3                      
ENTRY_TYPES                                                 apps/console/src/diaries/utils.ts:15:3                      
estimateTokenCount                                          apps/console/src/diaries/utils.ts:16:3                      
formatDateTime                                              apps/console/src/diaries/utils.ts:17:3                      
ENTRY_TYPE_OPTIONS                                          apps/console/src/diaries/utils.ts:21:14                     
getEntryTypeQuery                                 function  apps/console/src/diaries/utils.ts:29:17                     
MOBILE_BREAKPOINT                                           apps/console/src/hooks/useIsMobile.ts:3:14                  
TABLET_BREAKPOINT                                           apps/console/src/hooks/useIsMobile.ts:4:14                  
groupTasksByLane                                            apps/console/src/tasks/status.ts:25:3                       
statusToLane                                                apps/console/src/tasks/status.ts:26:3                       
TASK_LANES                                                  apps/console/src/tasks/status.ts:27:3                       
consoleCorrelationUrl                             function  apps/issue-lifecycle/src/status-comment.ts:36:17            
consoleAttemptUrl                                 function  apps/issue-lifecycle/src/status-comment.ts:48:17            
outputState                                       function  apps/issue-lifecycle/src/test-fakes.ts:41:17                
API_BASE_URL                                                apps/landing/src/api.ts:16:14                               
handleDiaryTags                                   function  apps/mcp-server/src/diary-tools.ts:315:23                   
handleGrantCreate                                 function  apps/mcp-server/src/grant-tools.ts:38:23                    
handleGrantRevoke                                 function  apps/mcp-server/src/grant-tools.ts:70:23                    
handleGrantList                                   function  apps/mcp-server/src/grant-tools.ts:102:23                   
handlePacksUpdate                                 function  apps/mcp-server/src/pack-tools.ts:319:23                    
handleRenderedPacksUpdate                         function  apps/mcp-server/src/pack-tools.ts:409:23                    
handlePacksDiff                                   function  apps/mcp-server/src/pack-tools.ts:511:23                    
EntryMapZoneSearchSchema                                    apps/mcp-server/src/schemas/entry-explore-schemas.ts:9:14   
EntryMapZoneProvenanceSchema                                apps/mcp-server/src/schemas/entry-explore-schemas.ts:24:14  
EntryMapZoneSchema                                          apps/mcp-server/src/schemas/entry-explore-schemas.ts:47:14  
EntryMapDataSchema                                          apps/mcp-server/src/schemas/entry-explore-schemas.ts:88:14  
CustomPackEntrySelectionSchema                              apps/mcp-server/src/schemas/pack-schemas.ts:107:14          
handleTasksContinue                               function  apps/mcp-server/src/task-tools.ts:177:23                    
handleTeamsList                                   function  apps/mcp-server/src/team-tools.ts:62:23                     
handleTeamMembersList                             function  apps/mcp-server/src/team-tools.ts:84:23                     
handleTeamsCreate                                 function  apps/mcp-server/src/team-tools.ts:109:23                    
handleTeamsJoin                                   function  apps/mcp-server/src/team-tools.ts:132:23                    
handleTeamsDelete                                 function  apps/mcp-server/src/team-tools.ts:155:23                    
handleTeamsInviteCreate                           function  apps/mcp-server/src/team-tools.ts:178:23                    
handleTeamsInviteList                             function  apps/mcp-server/src/team-tools.ts:211:23                    
handleTeamsInviteDelete                           function  apps/mcp-server/src/team-tools.ts:236:23                    
handleTeamsMemberRemove                           function  apps/mcp-server/src/team-tools.ts:264:23                    
DATABASE_URL                                                apps/rest-api-e2e/src/setup.ts:54:3                         
HYDRA_ADMIN_URL                                             apps/rest-api-e2e/src/setup.ts:55:3                         
KETO_READ_URL                                               apps/rest-api-e2e/src/setup.ts:57:3                         
KETO_WRITE_URL                                              apps/rest-api-e2e/src/setup.ts:58:3                         
KRATOS_ADMIN_URL                                            apps/rest-api-e2e/src/setup.ts:59:3                         
ServerConfigSchema                                          apps/rest-api/src/config.ts:27:14                           
DatabaseConfigSchema                                        apps/rest-api/src/config.ts:39:14                           
WebhookConfigSchema                                         apps/rest-api/src/config.ts:44:14                           
RecoveryConfigSchema                                        apps/rest-api/src/config.ts:48:14                           
OryConfigSchema                                             apps/rest-api/src/config.ts:52:14                           
ObservabilityConfigSchema                                   apps/rest-api/src/config.ts:63:14                           
RuntimeSessionStorageConfigSche…                            apps/rest-api/src/config.ts:131:14                          
TaskArtifactStorageConfigSchema                             apps/rest-api/src/config.ts:149:14                          
EmbeddingConfigSchema                                       apps/rest-api/src/config.ts:165:14                          
SecurityConfigSchema                                        apps/rest-api/src/config.ts:172:14                          
loadEmbeddingConfig                               function  apps/rest-api/src/config.ts:380:17                          
loadPackGcConfig                                  function  apps/rest-api/src/config.ts:390:17                          
loadTaskOrphanSweeperConfig                       function  apps/rest-api/src/config.ts:400:17                          
loadTaskArtifactStorageConfig                     function  apps/rest-api/src/config.ts:420:17                          
acceptsProblemJson                                          apps/rest-api/src/problems/index.ts:2:3                     
findProblemTypeByCode                                       apps/rest-api/src/problems/index.ts:9:3                     
findProblemTypeByStatus                                     apps/rest-api/src/problems/index.ts:10:3                    
getTypeUri                                                  apps/rest-api/src/problems/index.ts:11:3                    
problemTypes                                                apps/rest-api/src/problems/index.ts:13:3                    
DiaryTagCountSchema                                         apps/rest-api/src/schemas/diary.ts:58:14                    
PublicAuthorSchema                                          apps/rest-api/src/schemas/diary.ts:123:14                   
ContextPackEntrySchema                                      apps/rest-api/src/schemas/packs.ts:9:14                     
TaskActivityAnalyticsGroupBySch…                            apps/rest-api/src/schemas/tasks.ts:185:14                   
TaskActivityProductMetricsSchema                            apps/rest-api/src/schemas/tasks.ts:360:14                   
TaskTypeDescriptorSchema                                    apps/rest-api/src/schemas/tasks.ts:497:14                   
serializeRuntimeWorkspace                         function  apps/rest-api/src/services/runtime-slots.ts:171:17          
inflateRowCreator                                 function  apps/rest-api/src/utils/auth-principal.ts:142:23            
resolvePrincipal                                            apps/rest-api/src/utils/auth-principal.ts:191:10            
HumanOnboardingError              WorkflowExpor…  class     …s/rest-api/src/workflows/human-onboarding-workflow.ts:36:14
diaryTransferWorkflow             WorkflowExpor…            apps/rest-api/src/workflows/index.ts:4:3                    
TRANSFER_DECISION_EVENT           WorkflowExpor…            apps/rest-api/src/workflows/index.ts:7:3                    
HumanOnboardingError              WorkflowExpor…            apps/rest-api/src/workflows/index.ts:12:3                   
DEFAULT_WORKFLOW_TIMEOUT_MS       WorkflowExpor…            apps/rest-api/src/workflows/index.ts:49:3                   
runWorkflow                       WorkflowExpor…            apps/rest-api/src/workflows/index.ts:50:3                   
FOUNDING_ACCEPT_EVENT             WorkflowExpor…            apps/rest-api/src/workflows/index.ts:54:3                   
TeamFoundingTimeoutError          WorkflowExpor…            apps/rest-api/src/workflows/index.ts:60:3                   
teamFoundingWorkflow              WorkflowExpor…            apps/rest-api/src/workflows/index.ts:61:3                   
DEFAULT_WORKFLOW_TIMEOUT_MS       WorkflowExpor…            apps/rest-api/src/workflows/run-workflow.ts:14:14           
runWorkflow                       WorkflowExpor…  function  apps/rest-api/src/workflows/run-workflow.ts:33:23           
TeamFoundingTimeoutError          WorkflowExpor…  class     apps/rest-api/src/workflows/team-founding-workflow.ts:32:14 
DEFAULT_E2E_REST_API_URL                                    libs/bootstrap/src/e2e-harness.ts:26:14                     
DEFAULT_E2E_DATABASE_URL                                    libs/bootstrap/src/e2e-harness.ts:27:14                     
DEFAULT_E2E_HYDRA_PUBLIC_URL                                libs/bootstrap/src/e2e-harness.ts:29:14                     
DEFAULT_E2E_HYDRA_ADMIN_URL                                 libs/bootstrap/src/e2e-harness.ts:30:14                     
DEFAULT_E2E_KETO_READ_URL                                   libs/bootstrap/src/e2e-harness.ts:31:14                     
DEFAULT_E2E_KETO_WRITE_URL                                  libs/bootstrap/src/e2e-harness.ts:32:14                     
DEFAULT_E2E_KRATOS_ADMIN_URL                                libs/bootstrap/src/e2e-harness.ts:33:14                     
DEFAULT_E2E_AGENT_SCOPES                                    libs/bootstrap/src/e2e-harness.ts:34:14                     
DBOSWorkflowConflictError                                   libs/database/src/dbos.ts:154:3                             
MAX_PUBLIC_CONTENT_LENGTH                                   libs/diary-service/src/diary-service.ts:51:14               
nextStepId                                        function  libs/entry-explore-mcp-app/src/state/map.ts:117:17          
DEFAULT_TASK_ARTIFACT_MAX_BYTES                             …node-red-contrib-core/src/nodes/task-artifact-utils.ts:9:14
resolveTaskId                                     function  …ode-red-contrib-core/src/nodes/task-artifact-utils.ts:26:17
resolveTeamId                                     function  …ode-red-contrib-core/src/nodes/task-artifact-utils.ts:39:17
resolveAttemptN                                   function  …ode-red-contrib-core/src/nodes/task-artifact-utils.ts:53:17
resolveOverride                                   function  libs/node-red-contrib-core/src/nodes/task-builder.ts:118:17 
abortError                                        function  libs/pi-extension/src/abort-utils.ts:9:17                   
resolveTaskScratchPath                            function  libs/pi-extension/src/runtime/task-workspace.ts:130:17      
GUEST_TASK_SKILLS_MOUNT                                     libs/pi-extension/src/vm-manager.ts:42:14                   
HIGH_FRICTION_TURNS                                         libs/task-ui/src/analytics/constants.ts:13:14               
HIGH_FRICTION_FAILED_TOOL_CALLS                             libs/task-ui/src/analytics/constants.ts:14:14               
makeClient                                        function  packages/legreffier-cli/src/api.ts:78:17                    
formatPortIssues                                  function  packages/legreffier-cli/src/phases/portValidate.ts:213:17   
main                                              function  tools/src/release/go-artifact-publisher.cli.ts:110:23       
printGoArtifactReleasePlan                        function  tools/src/release/go-artifact-publisher.ts:531:17           
readText                                          function  tools/src/release/go-version-actions.ts:43:17               
readGoModulePath                                  function  tools/src/release/go-version-actions.ts:47:17               
resolveGoReleaseValidationRoots                   function  tools/src/release/go-version-actions.ts:200:17              
default                                           class     tools/src/release/go-version-actions.ts:731:22              
�[93m�[4mUnused exported types�[24m�[39m (65)
PiAgentDirSource                               type       apps/agent-daemon/src/lib/pi-agent-dir.ts:4:13                
MailRecord                                     interface  apps/console-e2e/src/helpers/mailslurper.ts:3:18              
GroupedTasks                                   type       apps/console/src/tasks/status.ts:24:8                         
TaskLane                                       type       apps/console/src/tasks/status.ts:28:8                         
TaskLaneId                                     type       apps/console/src/tasks/status.ts:29:8                         
UiResourceData                                 interface  apps/mcp-host/src/implementation.ts:25:18                     
EntryMapZoneSearch                             type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:22:13    
EntryMapZone                                   type       apps/mcp-server/src/schemas/entry-explore-schemas.ts:86:13    
CorsPluginOptions                              interface  apps/rest-api/src/plugins/cors.ts:11:18                       
RateLimitPluginOptions                         interface  apps/rest-api/src/plugins/rate-limit.ts:19:18                 
ProblemType                                    type       apps/rest-api/src/problems/index.ts:12:8                      
AgentPrincipal                                 type       apps/rest-api/src/schemas/principal.ts:37:8                   
HumanPrincipal                                 type       apps/rest-api/src/schemas/principal.ts:39:8                   
PrincipalIdentity                              type       apps/rest-api/src/schemas/principal.ts:41:8                   
RuntimeSlotSubject                             interface  apps/rest-api/src/services/runtime-slots.ts:33:18             
CreateTaskInput                                type       apps/rest-api/src/services/task.service.ts:2:8                
AuthContext                                    type       apps/rest-api/src/types.ts:14:3                               
RelationshipReader                             type       apps/rest-api/src/types.ts:16:3                               
RelationshipWriter                             type       apps/rest-api/src/types.ts:17:3                               
RuntimeSessionStorage                          type       apps/rest-api/src/types.ts:45:15                              
TaskAnalyticsService                           type       apps/rest-api/src/types.ts:46:15                              
TaskArtifactStorage                            type       apps/rest-api/src/types.ts:47:15                              
DiaryTransferDeps              WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:2:8                      
DiaryTransferResult            WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:3:8                      
TransferDecision               WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:8:8                      
HumanOnboardingDeps            WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:11:8                     
HumanOnboardingResult          WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:13:8                     
LegreffierOnboardingDeps       WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:24:8                     
MaintenanceDeps                WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:33:8                     
TaskDeletionWorkflowInput      WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:36:8                     
TaskDeletionWorkflowResult     WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:37:8                     
RegistrationDeps               WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:41:8                     
RegistrationResult             WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:42:8                     
RunWorkflowOptions             WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:51:8                     
FoundingMember                 WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:55:8                     
TeamFoundingDeps               WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:58:8                     
TeamFoundingResult             WorkflowExpor…  type       apps/rest-api/src/workflows/index.ts:59:8                     
RunWorkflowOptions             WorkflowExpor…  interface  apps/rest-api/src/workflows/run-workflow.ts:21:18             
AdoptionState                                  interface  docs/.vitepress/theme/auth/useAdoption.ts:38:18               
AdoptionStageKey                               type       docs/.vitepress/theme/auth/useAdoption.ts:285:13              
AdoptionStage                                  interface  docs/.vitepress/theme/auth/useAdoption.ts:293:18              
DocsTeam                                       interface  docs/.vitepress/theme/auth/useTeamSelection.ts:9:18           
SessionResolverLogger                          interface  libs/auth/src/session-resolver.ts:24:18                       
GroupCreator                                   interface  libs/database/src/repositories/group.repository.ts:16:18      
RuntimeWorkspaceKind                           type       …bs/database/src/repositories/runtime-slot.repository.ts:15:13
EntriesListArgs                                interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:22:18    
EntriesSearchArgs                              interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:32:18    
DiaryTagsArgs                                  interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:44:18    
EntriesGetArgs                                 interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:51:18    
PacksCreateArgs                                interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:57:18    
PacksUpdateArgs                                interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:65:18    
PacksProvenanceArgs                            interface  libs/entry-explore-mcp-app/src/adapter/tool-calls.ts:71:18    
CommandRegistrar                               type       libs/pi-extension/src/commands/index.ts:5:3                   
SessionMeta                                    type       libs/pi-extension/src/commands/index.ts:7:3                   
SubmitMissingRepromptEvent                     interface  libs/pi-extension/src/runtime/execute-pi-task.ts:2075:18      
RateLimitRetryOptions                          type       libs/sdk/src/retry.ts:5:15                                    
TaskArtifactAttemptInput                       interface  libs/task-artifact-service/src/task-artifacts.ts:62:18        
SuccessCriteriaRubricCriteri…                  interface  libs/task-ui/src/success-criteria.ts:80:18                    
RubricTemplate                                 interface  libs/task-ui/src/success-criteria.ts:123:18                   
AgentAdapter                                   type       packages/legreffier-cli/src/adapters/index.ts:13:15           
AgentAdapterOptions                            type       packages/legreffier-cli/src/adapters/index.ts:13:29           
ResolveInstallationStatus                      type       …ges/legreffier-cli/src/phases/portResolveInstallation.ts:6:13
VerifyInstallationStatus                       type       …ages/legreffier-cli/src/phases/portVerifyInstallation.ts:4:13
InitPhase                                      type       packages/legreffier-cli/src/state.ts:4:13                     
GoArtifactBuildStep                            type       tools/src/release/go-artifact-publisher.ts:74:13              
�[93m�[4mDuplicate exports�[24m�[39m (1)
GUEST_TASK_CONTEXT_MOUNT|GUEST_TASK_SKILLS_MOUNT  libs/pi-extension/src/vm-manager.ts
�[93m�[4mUnused catalog entries�[24m�[39m (4)
@anthropic-ai/claude-agent-sdk  default  pnpm-workspace.yaml:25:4 
@fastify/static                 default  pnpm-workspace.yaml:37:4 
@openai/codex-sdk               default  pnpm-workspace.yaml:62:4 
zod                             default  pnpm-workspace.yaml:153:3
�[33m�[4mConfiguration hints�[24m (6)�[39m
. �[90m(root)�[39m                      …p.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["."]�[90m (16 unused files)�[39m  
tools                         …p.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["tools"]�[90m (15 unused fil…�[39m
apps/rest-api                 …p.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/rest-api"]�[90m (4 unu…�[39m
apps/mcp-host                 …p.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["apps/mcp-host"]�[90m (2 unu…�[39m
libs/task-ui                  …p.config.ts  �[90mAdd �[97mentry�[90m and/or refine �[97mproject�[90m files in �[97mworkspaces["libs/task-ui"]�[90m (2 unus…�[39m
e2e/**/*.ts     …ps/rest-api  …p.config.ts  �[90mRefine �[97mentry�[90m pattern (no matches)�[39m                                           
 ELIFECYCLE  Command failed with exit code 1.

MoltNet-Diary: c9273b39-de4a-43f3-b6df-b8c8c2f79e97

MoltNet-Diary: b5eac454-6a06-4f05-92bc-290a4ab1efba

MoltNet-Diary: 444e324d-40b6-4cdd-acf7-066f46a2261e

MoltNet-Diary: 18e7bfaa-697c-46d7-b52e-d05e816e889e

MoltNet-Diary: b47c9461-20f6-4fcc-a69e-8b6ba0a4f0b7

MoltNet-Diary: f0dda143-c747-43c3-8327-473c6d2a36f8

legreffier Bot force-pushed the feat/nx-release-production branch 2 times, most recently from 965da0c to 25cff34 Compare July 4, 2026 17:42

legreffier Bot added 6 commits July 6, 2026 08:28

ci: replace release-please with nx release

3346d59

MoltNet-Diary: c9273b39-de4a-43f3-b6df-b8c8c2f79e97

ci: wire conventional nx release jobs

18cab42

MoltNet-Diary: b5eac454-6a06-4f05-92bc-290a4ab1efba

ci: derive release groups from nx affected

a9c9b2a

MoltNet-Diary: 444e324d-40b6-4cdd-acf7-066f46a2261e

ci: let nx release select changed projects

1ba2862

MoltNet-Diary: 18e7bfaa-697c-46d7-b52e-d05e816e889e

ci: make nx release manually triggered

a3e0c01

MoltNet-Diary: b47c9461-20f6-4fcc-a69e-8b6ba0a4f0b7

ci: place skip token last in release commit

ed482eb

MoltNet-Diary: f0dda143-c747-43c3-8327-473c6d2a36f8

legreffier Bot force-pushed the feat/nx-release-production branch from 25cff34 to ed482eb Compare July 6, 2026 06:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: replace release-please with Nx release#1534

ci: replace release-please with Nx release#1534
legreffier[bot] wants to merge 6 commits into
mainfrom
feat/nx-release-production

legreffier Bot commented Jun 30, 2026 •

edited by getlarge

Loading

Uh oh!

github-actions Bot commented Jun 30, 2026

Uh oh!

github-actions Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

legreffier Bot commented Jun 30, 2026 • edited by getlarge Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

github-actions Bot commented Jun 30, 2026

🚨 Dependency Audit — Vulnerabilities found

Uh oh!

github-actions Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Knip — Unused code or dependencies found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

legreffier Bot commented Jun 30, 2026 •

edited by getlarge

Loading

github-actions Bot commented Jun 30, 2026 •

edited

Loading