flvx/docs/superpowers/plans/2026-05-14-dependabot-remediation.md

Dependabot Remediation Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Resolve the open Dependabot dependency alerts for go-backend, vite-frontend, go-gost/x, and go-gost without mixing in unrelated business security changes.

Architecture: Apply targeted dependency upgrades per module, verify each module before moving to the next, and keep commits scoped to one dependency group. go-gost/x is fixed before go-gost because the main agent module uses replace github.com/go-gost/x => ./x.

Tech Stack: Go modules, pnpm, Vite/Rolldown, GitHub CLI Dependabot alerts API.

---

File Map

• Modify: go-backend/go.mod Responsibility: update github.com/jackc/pgx/v5 to the patched version.
• Modify: go-backend/go.sum Responsibility: reflect Go module checksum changes from the pgx upgrade.
• Modify: vite-frontend/package.json Responsibility: update direct vulnerable npm dependency versions and configure pnpm.overrides.
• Modify: vite-frontend/pnpm-lock.yaml Responsibility: resolve vulnerable npm transitive dependencies to patched versions.
• Modify: go-gost/x/go.mod Responsibility: update vulnerable Go dependencies used by the local github.com/go-gost/x module.
• Modify: go-gost/x/go.sum Responsibility: reflect checksum changes for go-gost/x.
• Modify: go-gost/x/dialer/dtls/dialer.go Responsibility: migrate DTLS import path from github.com/pion/dtls/v2 to github.com/pion/dtls/v3.
• Modify: go-gost/x/listener/dtls/listener.go Responsibility: migrate DTLS import path from github.com/pion/dtls/v2 to github.com/pion/dtls/v3.
• Modify: go-gost/go.mod Responsibility: sync vulnerable dependency versions for the main agent module while preserving local replace github.com/go-gost/x => ./x.
• Modify: go-gost/go.sum Responsibility: reflect checksum changes for the main agent module.

Task 1: Capture Baseline Alerts

Files:

• Read: GitHub Dependabot alerts API

• Read: go-backend/go.mod

• Read: vite-frontend/package.json

• Read: go-gost/x/go.mod

• Read: go-gost/go.mod

• Step 1: Query current open Dependabot alerts

Run:

gh api 'repos/Sagit-chu/flvx/dependabot/alerts?state=open&per_page=100' --paginate \
  --jq '.[] | [.number,.security_advisory.severity,.dependency.package.ecosystem,.dependency.manifest_path,.dependency.package.name,.security_vulnerability.vulnerable_version_range,(.security_vulnerability.first_patched_version.identifier // "")] | @tsv'

Expected: output includes alerts for github.com/jackc/pgx/v5, postcss, serialize-javascript, fast-uri, @babel/plugin-transform-modules-systemjs, github.com/sirupsen/logrus, github.com/quic-go/quic-go, github.com/quic-go/webtransport-go, and github.com/pion/dtls/v2.

• Step 2: Confirm starting versions in module manifests

Run:

rg -n 'jackc/pgx|postcss|serialize-javascript|pion/dtls|quic-go|webtransport-go|sirupsen/logrus' \
  go-backend/go.mod vite-frontend/package.json go-gost/x/go.mod go-gost/go.mod

Expected key lines:

go-backend/go.mod: github.com/jackc/pgx/v5 v5.7.3
vite-frontend/package.json: "postcss": "8.5.6"
vite-frontend/package.json: "serialize-javascript": "7.0.3"
go-gost/x/go.mod: github.com/pion/dtls/v2 v2.2.6
go-gost/x/go.mod: github.com/quic-go/quic-go v0.49.1
go-gost/x/go.mod: github.com/quic-go/webtransport-go v0.8.1-0.20241018022711-4ac2c9250e66
go-gost/x/go.mod: github.com/sirupsen/logrus v1.8.1

• Step 3: Confirm the DTLS advisory has no patched v2 release

Run:

go list -m -versions github.com/pion/dtls/v2
gh api 'advisories/GHSA-9f3f-wv7r-qc8r' --jq '{summary, vulnerabilities}'

Expected:

github.com/pion/dtls/v2 ... v2.2.12

Expected advisory facts:

github.com/pion/dtls/v2 vulnerable range <= 2.2.12 has no first_patched_version.
github.com/pion/dtls/v3 patched versions include 3.0.11 and 3.1.1.

• Step 4: Do not commit baseline capture

Run:

git status --short

Expected: no files are changed by Task 1.

Task 2: Fix go-backend pgx Alerts

Files:

• Modify: go-backend/go.mod

• Modify: go-backend/go.sum

• Step 1: Upgrade pgx to the patched version

Run:

(cd go-backend && go get github.com/jackc/pgx/v5@v5.9.2)

Expected: go-backend/go.mod changes github.com/jackc/pgx/v5 from v5.7.3 to v5.9.2, and go-backend/go.sum updates checksums.

• Step 2: Tidy backend module

Run:

(cd go-backend && go mod tidy)

Expected: command exits with code 0.

• Step 3: Verify backend dependency version

Run:

rg -n 'github.com/jackc/pgx/v5' go-backend/go.mod

Expected:

go-backend/go.mod: github.com/jackc/pgx/v5 v5.9.2

• Step 4: Run backend tests

Run:

(cd go-backend && go test ./...)

Expected: all backend packages pass.

• Step 5: Commit backend dependency fix

Run:

git add go-backend/go.mod go-backend/go.sum
git commit -m "fix: update backend pgx dependency"

Expected: one commit containing only go-backend/go.mod and go-backend/go.sum.

Task 3: Fix Frontend npm Alerts

Files:

• Modify: vite-frontend/package.json

• Modify: vite-frontend/pnpm-lock.yaml

• Step 1: Update direct dependency and pnpm overrides in package.json

Edit vite-frontend/package.json so the relevant entries are exactly:

{
  "devDependencies": {
    "postcss": "8.5.10"
  },
  "pnpm": {
    "overrides": {
      "@babel/plugin-transform-modules-systemjs": "7.29.4",
      "fast-uri": "3.1.2",
      "serialize-javascript": "7.0.5"
    }
  }
}

Remove the existing top-level "overrides" block after adding "pnpm.overrides". Keep all other existing dependencies and scripts unchanged.

• Step 2: Regenerate pnpm lockfile

Run:

(cd vite-frontend && pnpm install)

Expected: vite-frontend/pnpm-lock.yaml updates and install exits with code 0.

• Step 3: Verify vulnerable npm versions are absent

Run:

rg -n 'postcss@8\.5\.[0-9]:|"postcss":\s*"8\.5\.[0-9]"|serialize-javascript@[0-6]\.|serialize-javascript@7\.0\.[0-4]|fast-uri@3\.1\.[0-1]|plugin-transform-modules-systemjs@7\.29\.[0-3]' vite-frontend/pnpm-lock.yaml vite-frontend/package.json

Expected: no output.

• Step 4: Verify patched npm versions are present

Run:

rg -n 'postcss@8\.5\.10|serialize-javascript@7\.0\.5|fast-uri@3\.1\.2|plugin-transform-modules-systemjs@7\.29\.4' vite-frontend/pnpm-lock.yaml vite-frontend/package.json

Expected: output includes patched entries for postcss@8.5.10, serialize-javascript@7.0.5, fast-uri@3.1.2, and @babel/plugin-transform-modules-systemjs@7.29.4.

• Step 5: Build frontend

Run:

(cd vite-frontend && pnpm run build)

Expected: TypeScript and Rolldown/Vite build complete successfully.

• Step 6: Commit frontend dependency fix

Run:

git add vite-frontend/package.json vite-frontend/pnpm-lock.yaml
git commit -m "fix: update frontend vulnerable dependencies"

Expected: one commit containing only vite-frontend/package.json and vite-frontend/pnpm-lock.yaml.

Task 4: Fix go-gost/x Non-DTLS Alerts

Files:

• Modify: go-gost/x/go.mod

• Modify: go-gost/x/go.sum

• Step 1: Upgrade non-DTLS vulnerable Go dependencies

Run:

(cd go-gost/x && go get github.com/sirupsen/logrus@v1.8.3 github.com/quic-go/quic-go@v0.57.0 github.com/quic-go/webtransport-go@v0.10.0)

Expected: go-gost/x/go.mod resolves these dependencies to at least:

github.com/sirupsen/logrus v1.8.3
github.com/quic-go/quic-go v0.57.0
github.com/quic-go/webtransport-go v0.10.0

• Step 2: Tidy go-gost/x module

Run:

(cd go-gost/x && go mod tidy)

Expected: command exits with code 0.

• Step 3: Verify go-gost/x non-DTLS dependency versions

Run:

rg -n 'github.com/sirupsen/logrus|github.com/quic-go/quic-go|github.com/quic-go/webtransport-go' go-gost/x/go.mod

Expected output contains versions at or above:

github.com/sirupsen/logrus v1.8.3
github.com/quic-go/quic-go v0.57.0
github.com/quic-go/webtransport-go v0.10.0

• Step 4: Run go-gost/x tests after non-DTLS upgrades

Run:

(cd go-gost/x && go test ./...)

Expected: command exits with code 0. If it fails, stop this task before committing and inspect the first compiler error. The only permitted follow-up edits in this task are direct API-compatibility changes in files named by the compiler under go-gost/x; rerun this command after each edit.

• Step 5: Commit go-gost/x non-DTLS dependency fix

Run:

git add go-gost/x/go.mod go-gost/x/go.sum
git commit -m "fix: update gost quic dependencies"

Expected: one commit containing go-gost/x/go.mod and go-gost/x/go.sum, plus only the compiler-named go-gost/x files edited during Step 4.

Task 5: Migrate go-gost/x DTLS From v2 To v3

Files:

• Modify: go-gost/x/go.mod

• Modify: go-gost/x/go.sum

• Modify: go-gost/x/dialer/dtls/dialer.go

• Modify: go-gost/x/listener/dtls/listener.go

• Step 1: Update DTLS imports

In go-gost/x/dialer/dtls/dialer.go, change:

"github.com/pion/dtls/v2"

to:

"github.com/pion/dtls/v3"

In go-gost/x/listener/dtls/listener.go, change:

"github.com/pion/dtls/v2"

to:

"github.com/pion/dtls/v3"

• Step 2: Add patched DTLS v3 module

Run:

(cd go-gost/x && go get github.com/pion/dtls/v3@v3.0.11)

Expected: go-gost/x/go.mod contains github.com/pion/dtls/v3 v3.0.11 and no longer needs github.com/pion/dtls/v2.

• Step 3: Tidy and format go-gost/x

Run:

(cd go-gost/x && go mod tidy)
gofmt -w go-gost/x/dialer/dtls/dialer.go go-gost/x/listener/dtls/listener.go

Expected: command exits with code 0.

• Step 4: Verify v2 import and module are removed

Run:

rg -n 'github.com/pion/dtls/v2' go-gost/x
rg -n 'github.com/pion/dtls/v3' go-gost/x/go.mod go-gost/x/dialer/dtls/dialer.go go-gost/x/listener/dtls/listener.go

Expected:

first command: no output
second command: output includes go.mod, dialer.go, and listener.go

• Step 5: Run go-gost/x tests after DTLS migration

Run:

(cd go-gost/x && go test ./...)

Expected: command exits with code 0. If the compiler reports DTLS v3 API errors, edit only go-gost/x/dialer/dtls/dialer.go and go-gost/x/listener/dtls/listener.go, preserving the existing dtls.Config, dtls.ClientWithContext, and dtls.Listen flow, then rerun this command.

• Step 6: Commit DTLS migration

Run:

git add go-gost/x/go.mod go-gost/x/go.sum go-gost/x/dialer/dtls/dialer.go go-gost/x/listener/dtls/listener.go
git commit -m "fix: migrate gost dtls dependency"

Expected: one commit containing the DTLS import migration and Go module updates.

Task 6: Sync go-gost Main Module

Files:

• Modify: go-gost/go.mod

• Modify: go-gost/go.sum

• Step 1: Upgrade main module vulnerable dependency requirements

Run:

(cd go-gost && go get github.com/sirupsen/logrus@v1.8.3 github.com/quic-go/quic-go@v0.57.0 github.com/quic-go/webtransport-go@v0.10.0 github.com/pion/dtls/v3@v3.0.11)

Expected: go-gost/go.mod resolves vulnerable dependencies to patched versions and preserves this replace directive:

replace github.com/go-gost/x => ./x

• Step 2: Tidy main agent module

Run:

(cd go-gost && go mod tidy)

Expected: command exits with code 0.

• Step 3: Verify go-gost no longer references vulnerable DTLS v2

Run:

rg -n 'github.com/pion/dtls/v2' go-gost/go.mod go-gost/go.sum
rg -n 'github.com/pion/dtls/v3|github.com/quic-go/quic-go|github.com/quic-go/webtransport-go|github.com/sirupsen/logrus|replace github.com/go-gost/x => ./x' go-gost/go.mod

Expected:

first command: no output
second command: output includes dtls/v3, quic-go, webtransport-go, logrus, and the local replace directive

• Step 4: Run go-gost tests

Run:

(cd go-gost && go test ./...)

Expected: all packages pass.

• Step 5: Build go-gost binary

Run:

(cd go-gost && go build .)

Expected: build exits with code 0.

• Step 6: Commit go-gost module sync

Run:

git add go-gost/go.mod go-gost/go.sum
git commit -m "fix: sync gost main dependencies"

Expected: one commit containing only go-gost/go.mod and go-gost/go.sum.

Task 7: Final Dependabot Verification

Files:

• Read: GitHub Dependabot alerts API

• Read: Git working tree status

• Step 1: Run all verification commands once more

Run:

(cd go-backend && go test ./...)
(cd vite-frontend && pnpm run build)
(cd go-gost/x && go test ./...)
(cd go-gost && go test ./...)
(cd go-gost && go build .)

Expected: every command exits with code 0.

• Step 2: Query open Dependabot alerts after dependency updates

Run:

gh api 'repos/Sagit-chu/flvx/dependabot/alerts?state=open&per_page=100' --paginate \
  --jq 'group_by(.security_advisory.severity) | map({severity:.[0].security_advisory.severity,count:length})'

Expected: counts are lower than the baseline from Task 1. If Dependabot has not rescanned yet, run the detailed query from Task 1 and confirm the manifest files now contain patched versions locally.

• Step 3: Confirm no vulnerable dependency strings remain in manifests

Run:

rg -n 'github.com/jackc/pgx/v5 v5\.7\.3|postcss\"\\s*:\\s*\"8\.5\.6|serialize-javascript\"\\s*:\\s*\"7\.0\.3|github.com/pion/dtls/v2|github.com/quic-go/quic-go v0\.49\.1|github.com/quic-go/webtransport-go v0\.8\.1|github.com/sirupsen/logrus v1\.8\.1' \
  go-backend/go.mod vite-frontend/package.json go-gost/x/go.mod go-gost/go.mod

Expected: no output.

• Step 4: Confirm working tree contains only intentional changes

Run:

git status --short

Expected: no uncommitted files from this Dependabot remediation remain. Pre-existing unrelated files may still appear; do not stage or revert them.