Repository navigation
chore(deps): update @cursor/sdk to 1.0.38 - #21
Conversation
The new release drops @connectrpc/connect-node, which carried the undici 5 and @fastify/busboy advisories. The transitive undici pin behind @actions/http-client is refreshed to 6.29.1 so npm audit reports no advisories for the runtime tree.
🦋 Changeset detectedLatest commit: c07101d The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 58 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Description
Updates
@cursor/sdkfrom 1.0.28 to 1.0.38 and refreshes the transitiveundicipin.npm audit --omit=devon the committed lockfile reported four advisories (two high) through two paths:@cursor/sdk→@connectrpc/connect-node→undici5 and@fastify/busboy, and@actions/core→@actions/http-client→undici6.24.1. The SDK release drops@connectrpc/connect-nodeentirely, andundicimoves to 6.29.1 withinhttp-client's^6.23.0range, so the audit on the runtime tree is now clean. The API the action uses (Agent.create,send,stream,wait,cancel,RunResult) is unchanged between the two versions.Related Issues
None.
Checklist
.github/–only changes).github/–only community or template updates)Screenshots (if applicable)
N/A
Additional Notes
Both lockfiles move:
bun.lockfor development andpackage-lock.jsonfor the action's ownnpm ci. The top-level version field inpackage-lock.jsonwas stale at 1.0.1 and is resynced to 1.0.3.dist/does not change because the SDK stays external. TheIntegrationjobs exercise the new tree against the real API; the manual Smoke Test is worth a run before the next release.