Skip to content

Bump primitive-connect SDK to 1.35.3 for patched nodemailer - #48

Merged
poiley merged 1 commit into
mainfrom
fix/primitive-connect-sdk-advisories
Oct 8, 2026
Merged

poiley merged 1 commit into
mainfrom
fix/primitive-connect-sdk-advisories

Conversation

@poiley

@poiley poiley commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

Clears Dependabot alerts #1-#6 (nodemailer x5, source-map-js x1) in skills/primitive-connect. SDK 1.26.0 pulls nodemailer ^9.1.1; 1.35.3 is the first 1.x SDK on nodemailer ^10.0.15, so this stays on 1.x rather than taking the 2.0 major.

Resolved after the bump: nodemailer 10.0.16 (mailparser's nested copy 10.0.14), source-map-js 1.2.2.

Verified: npm test in skills/primitive-connect, 78/78 pass. The skill only imports @primitivedotdev/sdk/interactions.

🤖 Generated with Claude Code

SDK 1.26.0 depends on nodemailer ^9.1.1 (five open Dependabot
advisories, fixed in 10.0.2 through 10.0.9) and the lockfile carried
source-map-js 1.2.1 (fixed in 1.2.2). SDK 1.35.3 is the first 1.x release
on nodemailer ^10.0.15; the lockfile now resolves nodemailer 10.0.16 and
source-map-js 1.2.2. The skill's 78 tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@qodo-code-review

Copy link
Copy Markdown

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

@poiley
poiley merged commit 714b1b1 into main Oct 8, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant