lerkolabs/uptop
1
1
Fork 0
Code Issues 17 Pull Requests Actions Packages Projects 2 Releases 4 Wiki Activity

Migrate charm stack to v2 (wish v2 fixes GHSA-xjvp-7243-rg9h SCP path traversal) #126

New Issue
Open
opened 2026-06-12 20:57:03 +00:00 by lerko · 0 comments
lerko commented 2026-06-12 20:57:03 +00:00
Owner
Copy Link
Copy Source

grype flags github.com/charmbracelet/wish v1.4.7 with GHSA-xjvp-7243-rg9h (SCP middleware path traversal, CVSS 9.6 Critical). uptop does not use the SCP middleware — only wish core + bubbletea middleware — so the vulnerable path is unreachable (govulncheck agrees). Suppressed in .grype.yaml to unblock releases.

The real fix requires charm.land/wish/v2 (>= 2.0.1), which depends on charm.land/bubbletea/v2 — meaning the full TUI stack migrates together: bubbletea, bubbles, huh, lipgloss. Plan as its own arc post-v0.1.0:

  • charm.land/wish/v2 + charm.land/bubbletea/v2
  • bubbles/huh/lipgloss v2 counterparts
  • Remove the .grype.yaml ignore entry when done
grype flags github.com/charmbracelet/wish v1.4.7 with GHSA-xjvp-7243-rg9h (SCP middleware path traversal, CVSS 9.6 Critical). uptop does not use the SCP middleware — only wish core + bubbletea middleware — so the vulnerable path is unreachable (govulncheck agrees). Suppressed in .grype.yaml to unblock releases. The real fix requires charm.land/wish/v2 (>= 2.0.1), which depends on charm.land/bubbletea/v2 — meaning the full TUI stack migrates together: bubbletea, bubbles, huh, lipgloss. Plan as its own arc post-v0.1.0: - charm.land/wish/v2 + charm.land/bubbletea/v2 - bubbles/huh/lipgloss v2 counterparts - Remove the .grype.yaml ignore entry when done
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something isn't working
 distribution
Packaging, publishing, branding
 feature
New functionality
 polish
UX/visual refinement
 refactor
Code quality, no behavior change
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
lerko (Tyler Koenig)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: lerkolabs/uptop#126
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?