Skip to content

chore: update 6 vulnerable packages in trmlabs/agent-vault#5

Open
trm-security-agent wants to merge 6 commits into
trmlabs:mainfrom
trm-security-agent:security-agent/bundle-2026-07-01
Open

chore: update 6 vulnerable packages in trmlabs/agent-vault#5
trm-security-agent wants to merge 6 commits into
trmlabs:mainfrom
trm-security-agent:security-agent/bundle-2026-07-01

[Security Fix] Update go.opentelemetry.io/otel from 1.39.0 to 1.41.0 …

6e3840c
Select commit
Loading
Failed to load commit list.
StepSecurity Actions Security / StepSecurity Optional Checks succeeded Jul 1, 2026 in 0s

StepSecurity Optional Checks

Finished StepSecurity Optional Checks

  • PyPI Package Cooldown Check - Fails if any PyPI package version in the PR was released within the configured cooldown period
  • Pwn Request Vulnerabilities Check - Checks for Pwn Request vulnerabilities in the PR via risky triggers
  • Script Injection Check - Checks for script injection vulnerabilities in the PR
  • NPM Compromised Packages Check - Checks for compromised npm package versions in the PR
  • NPM Package Cooldown Check - Fails if any package version in the PR was released within the configured cooldown period, helping to avoid brand-new (and potentially unreviewed or malicious) releases
  • PyPI Compromised Packages Check - Checks for compromised PyPI package versions in the PR

Details

✅ PyPI Package Cooldown Check

No PyPI package upgrades to recent releases found in current PR.

✅ Script Injection Vulnerabilities Check

No Script Injection vulnerabilities found in this PR.

✅ Pwn Request Vulnerabilities Check

No Pwn Request vulnerabilities found in this PR.

✅ PyPI Compromised Packages Check

No compromised PyPI package versions found in current PR.

✅ NPM Compromised Packages Check

No Compromised npm packages are added in current PR.

✅ NPM Package Cooldown Check

No npm package upgrades to recent releases found in current PR.

The following npm packages are inspected in current PR

Package Name Previous Version Current Version file Current Version Release Date
ws 8.20.0 8.21.0 examples/daytona-openai-realtime/package-lock.json 2026-05-22T17:59:59Z
ws 8.21.0 examples/daytona-openai-realtime/package.json 2026-05-22T17:59:59Z
shell-quote 1.8.3 1.8.4 examples/daytona-openai-realtime/package-lock.json 2026-05-22T13:13:48Z
shell-quote 1.8.4 examples/daytona-openai-realtime/package.json 2026-05-22T13:13:48Z
@protobufjs/inquire 1.1.0 1.1.2 examples/daytona-openai-realtime/package-lock.json 2026-05-17T15:18:44Z
axios 1.15.2 1.16.1 examples/daytona-openai-realtime/package-lock.json 2026-05-13T16:22:46Z
axios 1.16.1 examples/daytona-openai-realtime/package.json 2026-05-13T16:22:46Z
protobufjs 7.5.5 7.5.6 examples/daytona-openai-realtime/package-lock.json 2026-04-28T00:45:30Z
protobufjs 7.5.6 examples/daytona-openai-realtime/package.json 2026-04-28T00:45:30Z
@protobufjs/utf8 1.1.0 1.1.1 examples/daytona-openai-realtime/package-lock.json 2026-04-27T20:31:28Z
@protobufjs/codegen 2.0.4 2.0.5 examples/daytona-openai-realtime/package-lock.json 2026-04-27T20:30:11Z
agent-base 6.0.2 examples/daytona-openai-realtime/package-lock.json 2020-10-23T19:33:15Z