Repository navigation
chore: promote CLI for 5.7.0 release - #205
Closed
finalerock44 wants to merge 9 commits into
Closed
finalerock44 wants to merge 9 commits into
finalerock44 wants to merge 9 commits into
Conversation
chore: merge production into dev after 5.6.0
pnpm audit started failing CI on 2026-09-29 for two new advisories in @modelcontextprotocol/sdk's transitive dependencies: - fast-uri 3.1.6 (GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g, high): raise the existing override's floor to 3.1.7. - ip-address 10.3.1 (GHSA-rpw4-54j3-4h4q, GHSA-2vr4-cq9g-pvrc, moderate): lockfile refresh to 10.7.2, within express-rate-limit's ^10.2.0.
…bot (#199) target-branch made security-update PRs ignore the groups and commit prefixes, and dev is already the default branch. Actions bumps now come monthly with a 7-day cooldown for supply-chain margin.
#198) Bumps the minor-and-patch group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.30.0` | `1.30.1` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.116.0` | `2.117.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.1` | `26.6.3` | | [eslint](https://github.com/eslint/eslint) | `10.10.0` | `10.11.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.8` | `3.9.9` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.70.0` | `8.70.1` | Updates `@modelcontextprotocol/sdk` from 1.30.0 to 1.30.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.30.0...1.30.1) Updates `@supabase/supabase-js` from 2.116.0 to 2.117.2 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.117.2/packages/core/supabase-js) Updates `@types/node` from 26.6.1 to 26.6.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.10.0 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.10.0...v10.11.0) Updates `prettier` from 3.9.8 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.8...3.9.9) Updates `tsx` from 4.23.13 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.13...v4.23.15) Updates `typescript-eslint` from 8.70.0 to 8.70.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@supabase/supabase-js" dependency-version: 2.117.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: typescript-eslint dependency-version: 8.70.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#201) feat(cloud): send runner_type in the notice context for the gpu1 retirement The API now seeds `deprecate-runner-gpu1-2026-11-09`, gated on `runner_type equals gpu1` (dcd#1454). This passes the requested --runner-type into the notice context so the CLI can show it. Older CLIs send no runner_type, so the gate evaluates false and they show nothing; the API's submit-time warning covers them. A unit test pins that behaviour, since the notice row relies on it instead of min_client_version. Also drops the "gpu1 ... available to all users" info line, and marks gpu1 as deprecated in the --runner-type help and the MCP tool description. Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
* feat(encrypt): default encryption from the org's beta setting (#1138) Encryption is now decided in one place, resolveEncryption, which replaces isEncryptionEnabled. The first of these that is set wins: 1. --encrypt / --no-encrypt (or the MCP tool's new encrypt input). 2. DCD_ENCRYPT, then the legacy DCD_ENCRYPT_BINARIES: 1/true is on and 0/false is off, in any case. 3. encryption.defaultOn from the compatibility data, which the API turns on for orgs in the client_encryption beta. 4. Off, which is also what an older API that omits the field gets. --no-encrypt used to be dropped (`args.encrypt ? true : undefined`), and DCD_ENCRYPT=0 meant the same as unset. Both now opt out, including of the org default. dcd cloud and the MCP tool resolve after the compatibility fetch they already make. dcd upload gains that fetch; since it never needed the data before, a failed fetch leaves the default off. uploadBinary and buildTestPayload now require encrypt, so neither can fall back to a default of its own. When the org default turns encryption on, the CLI says so once and names the opt-out, and the no-KEK errors no longer assume the user asked for encryption. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * feat(encrypt): pin KEKs only for known devicecloud.dev API URLs (#1138) resolveKekPublicKey picked the KEK through inferEnvFromApiUrl, which maps every unrecognised URL to prod, so a run against any other API encrypted for the prod KEK. That API can't unwrap it, so the uploads were unusable. kekEnvForApiUrl is a stricter twin used only for the KEK. It knows the hosts of the pinned apiUrls (api.devicecloud.dev, api.dev.devicecloud.dev) and localhost, which maps to dev, and nothing else. inferEnvFromApiUrl is unchanged for its other callers. On any other URL, checkKekForEncryption runs once per command, before anything is uploaded: - encryption from DCD_ENCRYPT or the org default is skipped, with a one-line notice, and the run uploads in plaintext as it did before - an explicit --encrypt fails with a message that names DCD_BINARY_KEK_PUBLIC, which still unlocks any URL Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * fix(upload): send usesFlutterEngine for encrypted Android uploads (#1138) The API picks the emulator renderer from binaries.metadata.usesFlutterEngine, which it sets by finding lib/x86_64/libflutter.so in the stored APK's central directory. It can't read an encrypted APK, so an encrypted Flutter app was left on lavapipe, which crashes Flutter apps (SIGILL, exit 132). An encrypted APK now carries the verdict in the finalise metadata, taken from the plaintext with the node-stream-zip reader the CLI already uses. It follows the API's rule: an entry whose name contains that path counts, so an APK gets the same renderer whether or not it is encrypted. An APK that can't be read sends no verdict, which the API also treats as unknown. Plaintext uploads are unchanged, and the API still detects those itself. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * feat(cli): hide --encrypt from --help (#1138) While client-side encryption is a per-org beta, --encrypt and --no-encrypt stay out of `dcd cloud --help` and `dcd upload --help`, but still parse. citty 0.2 can only hide commands (meta.hidden), not args, so the flag carries a local `hidden: true` marker (CliArgDef). src/index.ts removes args with that marker from the command before handing it to showUsage, for both --help and usage errors. The flag description now also says that the org default can turn encryption on, and that --no-encrypt or DCD_ENCRYPT=0 turns it off. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * feat(telemetry): record what each run encrypted (#1138) `command completed` and `command failed` now carry extra.encrypt = { binary, flow, env, source } for dcd cloud and dcd upload, where source is flag, env, server or off. Each part is set once it is actually encrypted: binary is false for --app-binary-id, and env is false when there are no env vars. When encryption was wanted but skipped on an unknown API URL, source still says what asked for it and every part is false. This lives on the event, not in meta: the API's /cli/logs proxy forwards only the meta fields it knows, but forwards each event's extra, so it reaches the cli-* datasets as extra.encrypt with no API change. dcd_run_cloud_test sends the same object on its `mcp tool completed` or `mcp tool failed` event. runTool now gives each handler a per-call telemetryExtra, so concurrent tool calls in one server can't mix their fields up. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> * chore(types): regenerate schema types from the dcd API swagger (#1138) Picks up encryption.defaultOn on the compatibility data, the flow and env download endpoints, and binary-download-url no longer returning a DEK, from the dcd feat/1138-encryption-beta swagger.json. The CLI reads the compatibility data through its hand-written CompatibilityData type, so nothing consumes the regenerated types yet. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
…it (#204) pnpm audit flagged new advisories on transitive deps: - brace-expansion <5.0.12 (via eslint > minimatch) - fast-uri <3.1.8 (via @modelcontextprotocol/sdk > ajv) Co-authored-by: Claude Opus 5.5 <[email protected]>
Both claude-code-review.yml and claude.yml were pinned to claude-opus-4-8. Co-authored-by: Claude Opus 5.5 <[email protected]>
14 tasks
finalerock44
added a commit
that referenced
this pull request
Oct 1, 2026
pnpm audit flagged GHSA-hxh3-vqpv-xpqv (hono/jsx XSS, moderate) on hono <4.13.7, pulled in via @modelcontextprotocol/sdk. It fails the lint-and-test audit step on the 5.7.0 promotion (#205).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Type of change
fix— bug fixfeat— new featureperf— performance improvementrefactor— code change that's neither a fix nor a featuredocs— documentation onlychore/ci/build/test— tooling, no user-facing change!or PR notes aBREAKING CHANGE:)Checklist
pnpm lintpassespnpm typecheckpassespnpm buildpassesCHANGELOG.md(release-please handles this)README.md/STYLE_GUIDE.mdupdated if behaviour or output changedHow to test