build(deps): bump react and @types/react in /website by dependabot[bot] · Pull Request #312 · wardnet/inforge

dependabot · 2026-09-19T15:33:16Z

Bumps react and @types/react. These dependencies needed to be updated together.
Updates react from 19.2.8 to 19.3.0

Release notes

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

2dc7da7 [test] Bump Jest to 30.4 (#37382)
4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
dbc3750 Update required references to GitHub repo (#36752)
900ae09 [flow] Bump flow to v0.317.0 (#36701)
fbb1370 [flow] Bump flow to v0.307.1 (#36199)
56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
74568e8 [Flight] Transport AggregateErrors.errors (#36156)
e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
3e1abcc [tests] Require exact error messages in assertConsole helpers (#35497)
Additional commits viewable in compare view

Updates @types/react from 19.2.18 to 19.3.0

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [react](https://github.com/react/react/tree/HEAD/packages/react) and [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react). These dependencies needed to be updated together. Updates `react` from 19.2.8 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react) Updates `@types/react` from 19.2.18 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) --- updated-dependencies: - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: "@types/react" dependency-version: 19.3.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-19T15:46:28Z

bulwark

❌ scan — 4 govulncheck findings

error output

… truncated to the last 20000 bytes — full log in the run artifact linked below …
e/internal/naming/naming.go
[gosec] 2026/09/19 15:43:54 Import directory: /home/runner/work/inforge/inforge/providers/hetzner
[gosec] 2026/09/19 15:43:54 Checking package: grant
[gosec] 2026/09/19 15:43:54 Checking file: /home/runner/work/inforge/inforge/internal/grant/database.go
[gosec] 2026/09/19 15:43:54 Checking file: /home/runner/work/inforge/inforge/internal/grant/grant.go
[gosec] 2026/09/19 15:43:54 Checking file: /home/runner/work/inforge/inforge/internal/grant/pki.go
[gosec] 2026/09/19 15:43:54 Import directory: /home/runner/work/inforge/inforge/internal/pathglob
[gosec] 2026/09/19 15:43:54 Checking package: pathglob
[gosec] 2026/09/19 15:43:54 Checking file: /home/runner/work/inforge/inforge/internal/pathglob/pathglob.go
[gosec] 2026/09/19 15:43:54 Import directory: /home/runner/work/inforge/inforge/internal/hostsecrets
[gosec] 2026/09/19 15:43:55 Checking package: hostsecrets
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/hostsecrets/hostsecrets.go
[gosec] 2026/09/19 15:43:55 Import directory: /home/runner/work/inforge/inforge/internal/meshcert
[gosec] 2026/09/19 15:43:55 Checking package: meshcert
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/meshcert/meshcert.go
[gosec] 2026/09/19 15:43:55 Import directory: /home/runner/work/inforge/inforge/internal/postgres
[gosec] 2026/09/19 15:43:55 Checking package: postgres
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/postgres/config.go
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/postgres/install.go
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/postgres/paths.go
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/postgres/role.go
[gosec] 2026/09/19 15:43:55 Checking file: /home/runner/work/inforge/inforge/internal/postgres/shell.go
[gosec] 2026/09/19 15:43:55 Import directory: /home/runner/work/inforge/inforge/internal/types
[gosec] 2026/09/19 15:43:56 Checking package: hetzner
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/providers/hetzner/compute.go
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/providers/hetzner/mesh.go
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/providers/hetzner/network.go
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/providers/hetzner/regions.go
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/providers/hetzner/storage.go
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/providers/hetzner/tls.go
[gosec] 2026/09/19 15:43:56 Import directory: /home/runner/work/inforge/inforge/schemas
[gosec] 2026/09/19 15:43:56 Checking package: schemas
[gosec] 2026/09/19 15:43:56 Checking file: /home/runner/work/inforge/inforge/schemas/embed.go
[gosec] 2026/09/19 15:43:56 Import directory: /home/runner/work/inforge/inforge/internal/agent
[gosec] 2026/09/19 15:43:57 Checking package: agent
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/decrypt.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/descriptor.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/env.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/exec.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/meshdescriptor.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/passwd.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/project.go
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/agent/run.go
[gosec] 2026/09/19 15:43:57 Import directory: /home/runner/work/inforge/inforge/internal/grafana
[gosec] 2026/09/19 15:43:57 Checking package: grafana
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/grafana/grafana.go
[gosec] 2026/09/19 15:43:57 Import directory: /home/runner/work/inforge/inforge/internal/grafanadash
[gosec] 2026/09/19 15:43:57 Checking package: types
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/types/types.go
[gosec] 2026/09/19 15:43:57 Import directory: /home/runner/work/inforge/inforge/internal/hostpaths
[gosec] 2026/09/19 15:43:57 Checking package: hostpaths
[gosec] 2026/09/19 15:43:57 Checking file: /home/runner/work/inforge/inforge/internal/hostpaths/hostpaths.go
[gosec] 2026/09/19 15:43:57 Import directory: /home/runner/work/inforge/inforge/internal/secretstore
[gosec] 2026/09/19 15:43:58 Checking package: grafanadash
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/crowdsec.go
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/custom.go
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/database.go
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/grafanadash.go
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/infrastructure.go
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/service.go
[gosec] 2026/09/19 15:43:58 Checking package: secretstore
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/secretstore/age.go
[gosec] 2026/09/19 15:43:58 Checking file: /home/runner/work/inforge/inforge/internal/secretstore/store.go
[gosec] 2026/09/19 15:43:59 Checking package: program
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/adr0042.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/dbbackup.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/dbcluster.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/dbdeploy.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/deploykey.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/encrypted.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/grafana.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/mesh.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/pkigrant.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/program.go
[gosec] 2026/09/19 15:43:59 Checking file: /home/runner/work/inforge/inforge/program/secretresolve.go
[gosec] 2026/09/19 15:44:00 Checking package: cloudflare
[gosec] 2026/09/19 15:44:00 Checking file: /home/runner/work/inforge/inforge/providers/cloudflare/dns.go
Results:


Summary:
  Gosec  : dev
  Files  : 138
  Lines  : 30994
  Nosec  : 45
  Issues : 0

go: downloading golang.org/x/vuln v1.7.0
go: downloading golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5
go: downloading golang.org/x/mod v0.39.0
go: downloading golang.org/x/tools v0.49.0
=== Symbol Results ===

Vulnerability #1: GO-2026-6443
    Server panic via missing authority or Host headers in google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2026-6443
  Module: google.golang.org/grpc
    Found in: google.golang.org/grpc@v1.82.1
    Fixed in: google.golang.org/grpc@v1.82.2
    Example traces found:
      #1: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.HandleStreams

Vulnerability #2: GO-2026-6355
    Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6355
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.55.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: cmd/inforge/stack.go:217:31: inforge.ephemeralWorkspace calls auto.NewLocalWorkspace, which eventually calls ssh.NewClientConn

Vulnerability #3: GO-2026-6354
    Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6354
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.55.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: cmd/inforge/stack.go:217:31: inforge.ephemeralWorkspace calls auto.NewLocalWorkspace, which eventually calls ssh.NewClientConn

Vulnerability #4: GO-2026-6348
    Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in
    google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2026-6348
  Module: google.golang.org/grpc
    Found in: google.golang.org/grpc@v1.82.1
    Fixed in: google.golang.org/grpc@v1.83.1
    Example traces found:
      #1: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.BufferSlice.MaterializeToBuffer
      #2: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.IsBelowBufferPoolingThreshold
      #3: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.NewBuffer
      #4: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.ReadAll
      #5: internal/secretstore/age.go:70:20: secretstore.Encrypt calls armor.armoredWriter.Close, which eventually calls mem.writer.Write
      #6: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Close
      #7: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Header
      #8: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Read
      #9: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.RecvCompress
      #10: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.TrailersOnly
      #11: internal/registry/registry.go:268:17: registry.registry.DNS calls sync.Once.Do, which eventually calls transport.NewHTTP2Client
      #12: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.NewServerTransport
      #13: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ServerStream.Read
      #14: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.Stream.ReadMessageHeader
      #15: cmd/inforge/preview.go:100:28: inforge.runPreview calls auto.Stack.Preview, which eventually calls transport.http2Client.Close
      #16: cmd/inforge/preview.go:100:28: inforge.runPreview calls auto.Stack.Preview, which eventually calls transport.http2Client.GracefulClose
      #17: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Client.NewStream
      #18: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.Close
      #19: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.HandleStreams

Your code is affected by 4 vulnerabilities from 2 modules.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
creating virtual environment...
installing semgrep from spec 'semgrep==1.173.0'...
done! ✨ 🌟 ✨
  installed package semgrep 1.173.0, installed using Python 3.12.3
  These apps are now available
    - pysemgrep
    - semgrep
                  
                  
┌────────────────┐
│ Debugging Info │
└────────────────┘
                  
  SCAN ENVIRONMENT
  versions    - semgrep 1.173.0 on python 3.12.3                                       
  environment - running in environment github-actions, triggering event is pull_request
Fixing git state for github action pull request
Not on head ref: 522a497d4c4b75e2d2bdc21cf689c1cd9b5ec092; checking that out now.
            
  CONNECTION
Using b429a6cc71e5ac1730e904afc3d71d378b494c4d as the merge-base of b429a6cc71e5ac1730e904afc3d71d378b494c4d and 522a497d4c4b75e2d2bdc21cf689c1cd9b5ec092
  Initializing scan (deployment=wardnet, scan_id=230562687)  
  Enabled products: Code, Supply Chain                               
        
  ENGINE
Semgrep Pro Engine will be installed in /opt/pipx/venvs/semgrep/lib/python3.12/site-packages/semgrep/bin/semgrep-core-proprietary
Downloading... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 316.6/316.6 MB 616.6 MB/s 0:00:00
Successfully installed Semgrep Pro Engine (version 1.173.0)!

  Using git merge base detected from environment for diff scans: b429a6cc71e5ac1730e904afc3d71d378b494c4d
               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 2 files tracked by git with 2944 Code rules, 88467 Supply Chain rules:
            
            
  CODE RULES
                                                                                                                        
  Language      Rules   Files          Origin      Rules                                                                
 ─────────────────────────────        ───────────────────                                                               
  <multilang>      46       2          Pro rules    1869                                                                
  json              4       1          Community    1075                                                                
                                                                                                                        
                    
  SUPPLY CHAIN RULES
                                                                                                                        
  Dependency Sources   Resolution Method   Ecosystem   Dependencies   Rules                                             
 ───────────────────────────────────────────────────────────────────────────                                            
  website/yarn.lock    Lockfile            Npm         1382           87006                                             
  go.mod               Lockfile            Gomod       146             1461                                             
                                                                                                                        
                                                                                                                        
  Analysis       Rules                                                                                                  
 ──────────────────────                                                                                                 
  Malicious      83324                                                                                                  
  Reachability    3022                                                                                                  
  Basic           2121                                                                                                  
                                                                                                                        
  Current version has 35 findings.

Creating git worktree from 'b429a6cc71e5ac1730e904afc3d71d378b494c4d' to scan baseline.
  Will report findings introduced by these commits (may be incomplete for shallow checkouts):
    * 522a497 build(deps): bump react and @types/react in /website

               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 3 files tracked by git with 35 Supply Chain rules:
            
            
  CODE RULES
  No code rules to run.
                    
  SUPPLY CHAIN RULES
                                                                                                                        
  Dependency Sources   Resolution Method   Ecosystem   Dependencies   Rules                                             
 ───────────────────────────────────────────────────────────────────────────                                            
  website/yarn.lock    Lockfile            Npm         1382              33                                             
  go.mod               Lockfile            Gomod       146                2                                             
                                                                                                                        
                                                                                                                        
  Analysis       Rules                                                                                                  
 ──────────────────────                                                                                                 
  Reachability      34                                                                                                  
  Basic              1                                                                                                  
                                                                                                                        
  Uploading scan results  
  Finalizing scan                         
                
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ CI scan completed successfully.
 • Findings: 0 (0 blocking)
 • Rules run: 115327
 • Targets scanned: 3
 • Parsed lines: ~100.0%
 • Scan skipped: 
   ◦ Matching --exclude patterns: 89
   ◦ Files matching .semgrepignore patterns: 124
 • Scan was limited to files changed since baseline commit.
 • For a detailed list of skipped files and lines, run semgrep with the --verbose flag
CI scan completed successfully.
  View results in Semgrep Cloud Platform:
    https://semgrep.dev/orgs/wardnet/findings?repo=wardnet/inforge&ref=refs/pull/312/merge
    https://semgrep.dev/orgs/wardnet/supply-chain/vulnerabilities?repo=wardnet/inforge&ref=refs/pull/312/merge
  No blocking findings so exiting with code 0

A new version of Semgrep is available. See https://semgrep.dev/docs/upgrading
[PASS] gosec
[FAIL] govulncheck
[PASS] semgrep
Error: 1 check(s) failed
bulwark: 1 check(s) failed

✅ coverage — go: 67.3% (baseline 67.3%)

📦 Full bulwark output — complete scan and coverage logs.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026

Navigation Menu

build(deps): bump react and @types/react in /website - #312

build(deps): bump react and @types/react in /website#312
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website/multi-7f19880bf6

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 19, 2026

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

Uh oh!

github-actions Bot commented Sep 19, 2026

bulwark

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants