fix: bump vulnerable transitive deps to resolve dependabot alerts - #499
Open
sriramveeraghanta wants to merge 1 commit into
Open
fix: bump vulnerable transitive deps to resolve dependabot alerts#499sriramveeraghanta wants to merge 1 commit into
sriramveeraghanta wants to merge 1 commit into
Conversation
Closes all 9 open Dependabot alerts, every one of them on pnpm-lock.yaml. Three of the five packages were held at vulnerable versions by the `overrides:` block in pnpm-workspace.yaml, so the fix is to raise the pins (same pattern as bb7fdf7): dompurify 3.4.11 -> 3.4.13 (#78 low, #79 medium) postcss 8.5.15 -> 8.5.26 (#71 high, #76 medium) js-yaml 3.15.0 -> 3.15.1 (#73 high) The other two had no override and only needed the lockfile refreshed — their parents' declared ranges already allow the patched versions: brace-expansion 5.0.6 -> 5.0.9 (#68, #70, #72 high; minimatch wants ^5.0.5) linkify-it 5.0.1 -> 5.0.2 (#69 high; markdown-it wants ^5.0.1) No override was added for those two on purpose: pnpm overrides apply tree-wide, and brace-expansion 5.x replaced the default export with a named `expand`, so pinning it would break any future consumer on minimatch 9.x, which imports it as a default. Every new version still satisfies its consumer's own declared range (dompurify ^3.3.3, postcss ^8.5.3, js-yaml ^3.13.1), so these are security floors rather than compatibility ceilings. Verified: check:format, dedupe --check, check:types (3/3) and build (both sites) all pass; pnpm audit reports no known vulnerabilities; the single-copy invariant holds for vue, vitepress and the voidzero theme. Claude-Session: https://claude.ai/code/session_019kCVtLs1Yho8dzcuzV4Hrn
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe workspace updates pinned override versions for ChangesDependency Override Updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This change updates vulnerable transitive dependency versions and matching workspace pins while preserving the existing dependency ranges; the reported checks pass, and no actionable merge-blocking risk remains beyond normal review. Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes all 9 open Dependabot alerts, every one of them on
pnpm-lock.yaml.What changed
Three of the five packages were held at vulnerable versions by the
overrides:block inpnpm-workspace.yaml, so the fix is to raise the pins — same pattern as bb7fdf7:dompurifypostcssjs-yamlThe other two had no override and only needed the lockfile refreshed — their parents' declared ranges already allow the patched versions:
brace-expansion^5.0.5linkify-it^5.0.1Why no override for the last two
pnpmoverrides apply tree-wide, andbrace-expansion5.x replaced the v1/v2 default export with a namedexpand. Pinning it would break any future consumer still on minimatch 9.x, which doesimport expand from 'brace-expansion'. The lockfile pin is durable on its own here: 5.0.9 and 5.0.2 are the tops of their respective ranges, so re-resolution lands on the patched versions.Every new version still satisfies its consumer's own declared range (
dompurify ^3.3.3,postcss ^8.5.3,js-yaml ^3.13.1) — these are security floors, not compatibility ceilings.Verification
pnpm check:format,pnpm dedupe --check,pnpm check:types(3/3),pnpm build(both sites) — all passpnpm audit— no known vulnerabilities foundvue@3.5.41,vitepress@2.0.0-alpha.16,@voidzero-dev/vitepress-theme@4.8.4overrides:block matchespnpm-workspace.yaml, so--frozen-lockfilewon't fail in CINot covered: a live browser render of the two mermaid pages (
dompurifyis consumed client-side by mermaid). Both dompurify advisories are sanitization hardening, so the risk is low, but it is unverified at runtime.https://claude.ai/code/session_019kCVtLs1Yho8dzcuzV4Hrn
Summary by CodeRabbit