Repository navigation
fix(deps): apply safe Dependabot security updates - #62
Merged
Merged
Conversation
Raise next to 15.5.29 and refresh the lockfile for every advisory that has a patched release inside the parent version range. Overrides cover a few exact pins where a same-major patch exists. Breaking upgrades are left in place. Co-authored-by: Jon Ursenbach <erunion@users.noreply.github.com>
Contributor
 [High impact] The reviewed changes appear safe to merge; no actionable bugs were confirmed. Reviews (1) · Last reviewed commit: "fix(deps): apply safe Dependabot securit..." · Reviewed by Greptile |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates every open dependency advisory on
mainthat has a patched release inside the parent version range.nextmoves from^15.0.0/15.5.12to^15.5.29. The lockfile picks up the rest.dist-gha/index.jsis rebuilt becausenccinlines these dependencies for the GitHub Action.131 advisories are cleared. 11 stay open because the patched release is a breaking upgrade, or because no patched release exists.
Alert index: https://github.com/readmeio/cli/security/dependabot
This run's GitHub token cannot read Dependabot alert numbers (
vulnerability_alertsis denied). Each row links this repository's open Dependabot alerts for that package, and the GitHub Advisory the alert is filed against.Direct updates
next@hono/node-server1.19.14→2.1.6is a major, and it is the patched line (>=2.1.3).@modelcontextprotocol/sdk@1.32.2allows^1.19.9 \|\| ^2.0.5.sharp0.34.5→0.35.5is allowed by Next15.5.29(^0.34.3 \|\| ^0.35.5).Nested updates (parent range already allowed the patch)
@hono/node-server@modelcontextprotocol/sdk^1.19.9 || ^2.0.5@modelcontextprotocol/sdk@anthropic-ai/claude-agent-sdk^1.29.0body-parserexpress^2.2.1/~1.20.5brace-expansionminimatch^1.1.7dompurifymermaid^3.3.3fast-uriajv^3.0.1hono@modelcontextprotocol/sdk^4.11.4ip-addressexpress-rate-limit^10.2.0js-yamlcosmiconfig^4.1.0lodash-esdagre-d3-es^4.17.21mermaid@readme/markdown^11.12.0minimatchgraphql-config4.2.3path-to-regexpexpress~0.1.13picomatchmicromatch^2.3.1proxy-addrexpress^2.0.7qsexpress~6.16.0sharpnext^0.34.3 || ^0.35.5uuidmermaid^11.1.0 || ^12 || ^13 || ^14.0.0ws@graphql-tools/url-loader^8.12.0zod@anthropic-ai/claude-agent-sdk^4.0.0brace-expansion@5.0.12andpath-to-regexp@8.4.2were already on a patched release and stay. Directjs-yaml@5.5.0is unchanged.express@5.2.1(the SDK copy) is unchanged.Overrides
Same-major resolutions. The parent range did not let
npm audit fixselect them on its own.@graphql-tools/executor-graphql-ws,@graphql-tools/executor-legacy-wsws@8.22.1(were pinned at8.13.0)cosmiconfigjs-yaml@4.3.2(range is already^4.1.0; the lock was stuck on4.1.1)express-rate-limitexpress@4.22.3(4.22.1depends onqs@~6.14.0, which cannot reachqs@6.16.2)graphql-configminimatch@4.2.6(was pinned at4.2.3). Clears the 4.x ReDoS advisories.minimatch@11is not applieduuid^11.1.1. GHSA-w5hq-g745-h8pq is fixed in11.1.1. Mermaid also allows uuid 12–14; this stays on the minimum patched 11.x releaseLeft unchanged
These still show in
npm audit. The suggested fix is a major, a downgrade, or an exact pin.postcss@8.4.31next@15.5.29depends on8.4.31exactly. Other copies are8.5.32. Patched line is>=8.5.23. The full fix isnext@16.4.5.@graphql-tools/executor-legacy-ws@0.0.11@graphql-tools/url-loader@7.17.18(latest 7.x, required bygraphql-config@4.5.0) depends on^0.0.11. Patched release is1.1.36.@graphql-tools/utils@9.2.1^9.2.1. Patched release is12.0.1.minimatch3.1.5 / 4.2.6 / 10.2.6>=11.0.1. eslint 9 pins^3.1.5, typescript-eslint pins^10.2.2, and graphql-config is on 4.2.x.deepmerge@4.3.1@readme/markdownto10.2.11.@readme/markdown@16still depends ondeepmerge@^4.3.1.katex@0.16.470.16.28.mermaid@11.17.2requires^0.16.47. Patched release is0.18.2.Test plan
npm ci --ignore-scriptsnpm test— 21 files, 283 tests passednpm run build:gha