Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

🤖 security: Dependabot updates fail on every run; 12 open alerts have no PRs

Open
  • Is something wrong?
#7,384 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
bun, github-actions, typescript
Domain
devops, security

Research direction

Start with the failed “Dependabot Updates” runs (for example, 40059914613) and the repository’s Bun and Dependabot configuration; the error says Bun is misconfigured, but the issue does not identify the cause. Trace the configuration that Dependabot uses and confirm a run can fetch files successfully. The listed package updates and follow-up checklist are separate work with dependencies and runtime checks; coordinate with the named fix-next lane and coordinator.

Written by the indexing model from the issue text.

Description

bug

Problem

Dependabot security updates fail on every run, so 12 open Dependabot alerts (7 high) have no update PRs. The last 20 "Dependabot Updates" runs all failed with:

Error during file fetching; aborting: Dependabot detected that Bun is misconfigured in this repository.

(for example runs 40059914613 and 40059913579, 2026-10-24 03:50Z). Some alerts have been open since 2026-07-21.

Open alerts (2026-10-24)

What ships in the app (dependencies, used from src/):

Package Pinned Severity Fixed in
@modelcontextprotocol/client 2.0.0 high (CVE-2026-104850), medium (CVE-2026-111769) 2.3.0
stream-json (used by historyRowScanner.ts) 3.6.0 medium (CVE-2026-114129) 3.7.0
sharp (lazy-loaded by resizeRasterImageAttachment.ts for attach_file; the macOS build ships its runtime) ^0.34.5 (0.34.5) high x3 0.35.5
happy-dom (web_fetch.ts parses every fetched page with a happy-dom Window) 20.0.11 (patched, see #6344 / #6348) high x3 (incl. CVE-2026-115895) 21.0.4

Dev tooling only (uv.lock, Xum ships no Python):

Package Severity Fixed in
filelock high (CVE-2026-112940), low x2 4.2.1

Plan

  1. One PR bumps the shipped packages: @modelcontextprotocol/client 2.3.0 and stream-json 3.7.0.
  2. One PR bumps sharp to 0.35.5 (a shipped package: needs the perf gate and a macOS attach-file runtime check) and filelock to 4.2.1 (uv lock --upgrade-package filelock).
  3. happy-dom 21.x gets its own PR, because 20.0.11 carries a local patch (#6344 / #6348). It ships in the app (web_fetch).
  4. Find why Dependabot reports Bun as misconfigured, so future alerts get PRs again.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Correction (2026-10-24): the first version of this issue listed sharp as scripts-only. The desk lane found the runtime use in src/node/utils/attachments/resizeRasterImageAttachment.ts (import type plus a lazy load, which my search missed).

Follow-up checklist

  • After 2026-10-27, remove minimumReleaseAgeExcludes = ["happy-dom"] from bunfig.toml (added by #7393 for happy-dom 21.0.4, released 2026-10-20). Owner: the F159 fix-next lane, then the issue fix coordinator desk.
  • When litellm allows filelock >= 4.2.1, run uv lock --upgrade-package filelock (see the comment above).
    Second correction (2026-10-24): happy-dom is also shipped, not test-only. src/node/services/tools/web_fetch.ts imports it to parse fetched pages. The desk lane and the perf owner found it; my search missed it again.
Dominant language
TypeScript
Stars
2.1k
Forks
140
Avg merge
3h 23m
Merged PRs (30d)
953

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from coder/xum

All issues in coder/xum

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.