4 Commits

Author	SHA1	Message	Date
user	bfdd786962	chore(deps): refresh dependency locks	2026-05-04 11:36:18 -07:00
user	8d1493ed08	fix(security): bump vulnerable dependencies ... pip: - cryptography 43.0.3 → 46.0.7 (5 CVEs including CVSS 8.2 ECDH key leak) npm: - hono 4.1.4/4.12.7 → 4.12.12 (prototype pollution, cookie injection, path traversal, middleware bypass, IP matching bypass) - @hono/node-server 1.19.6 → 1.19.13 (serveStatic middleware bypass) - vite 7.3.1 → 7.3.2 (file read via WebSocket, path traversal, fs.deny bypass) - lodash override 4.17.23 → 4.18.1 (code injection via _.template, prototype pollution via _.unset/_.omit) mlflow left at 3.9.0 — 2 of 3 alerts have no upstream fix, and 3.11.1 is blocked by exclude-newer (transitive dep chain). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-09 19:35:19 +00:00
Yuneng Jiang	006d481025	[Fix] Remove neon CLI dependency and pin all JS dependencies ... Remove @neondatabase/api-client and neonctl to address CVE-2026-25639 (axios supply chain vulnerability). Pin all JS dependencies to exact versions across all package.json files to prevent future supply chain attacks via semver range resolution. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-01 16:15:32 -07:00
Krrish Dholakia	6c34e48180	feat(index.ts): initial commit for proxy edge worker ... testing to see if a js worker improves proxy perf (and by how much)	2024-03-27 10:15:20 -07:00