Repository navigation
fix(linux): drop unmaintained dbus-next so installs no longer pull critical advisories - #148
Merged
Merged
Conversation
…op vulnerable deps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installing
@mohak34/opencode-notifier@1.1.0into an empty project makesnpm auditreport criticalform-dataandtaradvisories. They come fromdbus-next@0.10.2(the Linux D-Bus notification fallback), unmaintained since 2022: its optionalusocketdependency pullsnode-gyp@7, which pullsrequest,form-data@2.3.3andtar@6.2.1. That chain only runs at install time to compile a native addon, but every user's audit flags it and upstream will never fix it.This swaps
dbus-nextfor@particle/dbus-next, a maintained fork with the same API that dropsusocket. The code change is the import specifier insrc/notify-linux.ts, the test fixture daemon, one test, and the build's--externalflag. No behavior or config changes.Hit every surface:
src/notify-linux.ts; nothing host-specific changed.Checked (Linux, headless):
bun run typecheckandbun run buildpass; bothdist/entry points keep the fork as an external import.bun test: 257 pass, 1 skip, 0 fail, identical tomain. The D-Bus tests run a privatedbus-run-sessionwith the fixture notification daemon, so the fork is exercised end to end.npm pack, installed the tarball into an empty project:npm auditwent from critical and high to 3 moderate. It also imports under Node.uuidvianode-notifier@10. node-notifier 11 removes it but changes macOS behavior (icons ignored, permission prompt again), so that is left for a separate change after testing on a Mac.Not checked: a real desktop notification daemon (GNOME, KDE) on a live session, macOS, Windows.
Review: 1 round by GPT-6.1 Sol (API compatibility of the fork vs dbus-next 0.10.2 including the private socket unref, fd passing, dist externals, advisories on the new tree). No findings.
Generated with Claude Code using Claude Opus 5.5