Skip to content

build(deps): resolve open dependency PRs — @babel/parser 8 (+compat), supabase-js floor; hold TypeScript 7 #1014

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BigSimmo merged 3 commits into from
Jul 20, 2026
+180 −33
Merged

build(deps): resolve open dependency PRs — @babel/parser 8 (+compat), supabase-js floor; hold TypeScript 7 #1014

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2f92eed
build(deps-dev): @babel/parser 7→8 (+compat) and pin @supabase/supaba…
claude Jul 20, 2026
02920b7
build(deps): remediate brace-expansion ReDoS to clear the dependency-…
claude Jul 20, 2026
ace7a47
Merge branch 'main' into claude/resolve-dependency-prs-rmb9hv
BigSimmo Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
156 changes: 143 additions & 13 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 5 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@
"dependencies": {
"@next/env": "16.2.10",
"@supabase/ssr": "^0.12.3",
"@supabase/supabase-js": "^2.108.2",
"@supabase/supabase-js": "^2.110.7",
"exceljs": "^4.4.0",
"jszip": "^3.10.1",
"lucide-react": "^1.25.0",
Expand All @@ -202,11 +202,13 @@
"postcss": "^8.5.15",
"esbuild": "0.28.1",
"tmp": "^0.2.7",
"uuid": "^11.1.1"
"uuid": "^11.1.1",
"brace-expansion@1": "^1.1.16",
"brace-expansion@2": "^2.1.2"
},
Comment on lines +205 to 208

@coderabbitai coderabbitai Bot Jul 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

npm ls --all brace-expansion uuid
node - <<'NODE'
const fs = require("node:fs");
const lock = JSON.parse(fs.readFileSync("package-lock.json", "utf8"));
for (const [key, value] of Object.entries(lock.packages ?? {})) {
  if (/(^|\/)(brace-expansion|uuid)$/.test(key)) {
    console.log(key, value.version);
  }
}
NODE

Repository: BigSimmo/Database

Length of output: 1106

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== uuid/brac-expansion usages in repo ==\n'
rg -n --hidden --glob '!package-lock.json' --glob '!node_modules' '\buuid\b|brace-expansion' .

printf '\n== package-lock entries ==\n'
node - <<'NODE'
const fs = require("node:fs");
const lock = JSON.parse(fs.readFileSync("package-lock.json", "utf8"));
for (const [key, value] of Object.entries(lock.packages ?? {})) {
  if (/(^|\/)(brace-expansion|uuid)$/.test(key)) {
    console.log(`${key} ${value.version}`);
  }
}
NODE

Repository: BigSimmo/Database

Length of output: 50374

🌐 Web query:

brace-expansion vulnerability patched versions 1.x 2.x 5.x uuid 11 breaking changes older API

💡 Result:

For the brace-expansion library, two primary denial-of-service (DoS) vulnerabilities have been identified: 1. Zero-step sequence vulnerability (CVE-2026-33750): A brace pattern with a zero step value (e.g., {1..2..0}) causes infinite loops and memory exhaustion [1][2][3]. Patched versions include 1.1.13, 2.0.3, 3.0.2, and 5.0.5 [1][2][3]. 2. Exponential-time expansion vulnerability (CVE-2026-13149): Consecutive non-expanding {} brace groups cause exponential CPU consumption [4][5][6]. Patched versions include 1.1.16, 2.1.2, and 5.0.7 [4]. For the uuid library, version 11 introduced significant breaking changes [7][8][9]. Key changes include: - Migration to TypeScript: The library is now written in TypeScript; users should remove @types/uuid from dependencies [10]. - ESM Migration: The codebase transitioned to ECMAScript Modules (ESM) [7][9]. - API Changes: - Default export (v4) is removed [7][9]. - Deep imports (e.g., require('uuid/v4')) are no longer supported [7][9]. - Changes in options handling for v1, v6, and v7: Passing an options argument now explicitly disables internal state utilization for uniqueness, applying defaults instead [11][10]. - Binary UUIDs are now returned as Uint8Array, which may affect callers of parse or stringify [10]. - Support Changes: Support for Node.js versions below 16 and certain older browsers (like IE 11) was dropped [7][8][9]. The minified UMD build was also removed [9].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== direct npm-package uuid references ==\n'
rg -n --hidden --glob '!package-lock.json' --glob '!node_modules' --glob '!supabase/**' \
  'from ["'\'']uuid["'\'']|require\(["'\'']uuid["'\'']\)|uuid/v[0-9]|`@types/uuid`' \
  package.json ./**/*.js ./**/*.jsx ./**/*.ts ./**/*.tsx ./**/*.mjs ./**/*.cjs || true

printf '\n== package.json uuid-related entries ==\n'
node - <<'NODE'
const pkg = JSON.parse(require("node:fs").readFileSync("package.json", "utf8"));
for (const [k, v] of Object.entries({dependencies: pkg.dependencies, devDependencies: pkg.devDependencies, overrides: pkg.overrides})) {
  if (!v) continue;
  for (const [name, ver] of Object.entries(v)) {
    if (name.includes('uuid') || name.includes('brace-expansion')) {
      console.log(k, name, ver);
    }
  }
}
NODE

Repository: BigSimmo/Database

Length of output: 383

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== package-lock uuid consumers ==\n'
node - <<'NODE'
const fs = require('node:fs');
const lock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'));
for (const [path, pkg] of Object.entries(lock.packages ?? {})) {
  if (path === 'node_modules/exceljs' || /(^|\/)uuid$/.test(path) || /(^|\/)brace-expansion$/.test(path) || /(^|\/)minimatch$/.test(path)) {
    const deps = pkg.dependencies || {};
    console.log(path || '<root>', 'version=' + (pkg.version ?? ''), 'deps=' + JSON.stringify(deps));
  }
}
NODE

printf '\n== source imports of uuid/exceljs ==\n'
git ls-files | rg '\.(js|jsx|ts|tsx|mjs|cjs|json|yml|yaml)$' | xargs rg -n '\b(uuid|exceljs)\b' || true

Repository: BigSimmo/Database

Length of output: 40598

🌐 Web query:

exceljs source uuid usage v4 named import uuid 11 compatibility

💡 Result:

ExcelJS currently pins the uuid dependency to ^8.3.0 in version 4.4.0 [1][2]. While the library uses uuid's v4 method internally via the named CommonJS import const {v4: uuidv4} = require('uuid') [1], it does not natively support or officially bundle uuid 11 or later [2]. Users encountering security advisories or requiring compatibility with newer uuid versions typically address this by using package manager overrides (npm) or resolutions (yarn) to force the transitive dependency to a newer version, such as uuid 14.0.0 [1][3]. Because ExcelJS consumes uuid via a simple, common v4 call, this override is generally compatible and effective without requiring changes to ExcelJS source code [1][3]. If you are using modern Node.js environments, you can apply this override in your package.json to resolve security vulnerabilities or compatibility issues: For npm: "overrides": { "exceljs": { "uuid": "^14.0.0" } } For yarn: "resolutions": { "exceljs/uuid": "^14.0.0" } Note that uuid 11 and later versions are ESM-only, which can cause issues if your environment or older build tools (like older versions of Jest or specific CommonJS setups) expect the older CommonJS structure [3][4]. Using a recent version of Node.js (e.g., 22+) is recommended to avoid module compatibility errors [3].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== ExcelJS call sites ==\n'
rg -n 'ExcelJS|exceljs' src scripts tests --glob '!**/node_modules/**' --glob '!package-lock.json' || true

printf '\n== src/lib/extractors/document.ts (selected lines) ==\n'
sed -n '1,220p' src/lib/extractors/document.ts

printf '\n== scripts/generate-sample-documents.ts (selected lines) ==\n'
sed -n '1,220p' scripts/generate-sample-documents.ts

Repository: BigSimmo/Database

Length of output: 18604

Drop the uuid 11 override exceljs@4.4.0 still pulls uuid through a CommonJS require, and the codebase uses ExcelJS in src/lib/extractors/document.ts and scripts/generate-sample-documents.ts. The brace-expansion edges are already on patched releases (1.1.16, 2.1.2, 5.0.7).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 205 - 208, Remove the uuid 11 override from the
package dependency overrides, while retaining the existing brace-expansion
overrides at their patched versions. Do not change the ExcelJS usage in the
document extractor or sample-generation script.

"devDependencies": {
"@axe-core/playwright": "^4.12.1",
"@babel/parser": "^7.29.7",
"@babel/parser": "^8.0.4",
"@next/bundle-analyzer": "^16.2.10",
"@tailwindcss/postcss": "^4.3.3",
"@testing-library/dom": "^10.4.1",
Expand Down
45 changes: 29 additions & 16 deletions tests/architecture-boundaries.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,9 @@ function sourceFiles() {
function parseModuleSource(sourceText: string) {
return parse(sourceText, {
sourceType: "module",
plugins: ["jsx", "typescript", "importAttributes"],
// @babel/parser 8 parses import attributes by default; the standalone
// "importAttributes" plugin was removed (and is now a type error).
plugins: ["jsx", "typescript"],
});
}

Expand Down Expand Up @@ -60,9 +62,33 @@ function moduleSpecifiersFromSource(_filePath: string, sourceText: string) {
}
}

const addDynamicSpecifier = (moduleSpecifier: Record<string, unknown> | undefined) => {
if (!moduleSpecifier) return;
if (moduleSpecifier.type === "StringLiteral" && typeof moduleSpecifier.value === "string") {
dynamicImports.add(moduleSpecifier.value);
} else if (
moduleSpecifier.type === "TemplateLiteral" &&
Array.isArray(moduleSpecifier.expressions) &&
moduleSpecifier.expressions.length === 0 &&
Array.isArray(moduleSpecifier.quasis) &&
moduleSpecifier.quasis.length === 1
) {
const cooked = ((moduleSpecifier.quasis[0] as Record<string, unknown>).value as Record<string, unknown>)?.cooked;
if (typeof cooked === "string") dynamicImports.add(cooked);
}
};

const visit = (node: unknown) => {
if (!node || typeof node !== "object") return;
const current = node as Record<string, unknown>;
// @babel/parser 8 models dynamic `import(...)` as an ESTree-aligned
// ImportExpression (specifier in `source`, import-attributes in `options`).
// @babel/parser 7 modelled it as a CallExpression whose callee is an
// `Import` node with the specifier in `arguments[0]`. Handle both shapes so
// this boundary graph stays parser-major agnostic.
if (current.type === "ImportExpression") {
addDynamicSpecifier(current.source as Record<string, unknown> | undefined);
}
const argumentsList = Array.isArray(current.arguments) ? current.arguments : null;
if (
current.type === "CallExpression" &&
Expand All @@ -71,21 +97,8 @@ function moduleSpecifiersFromSource(_filePath: string, sourceText: string) {
(argumentsList.length === 1 || argumentsList.length === 2)
) {
const callee = current.callee as Record<string, unknown>;
const moduleSpecifier = argumentsList[0] as Record<string, unknown> | undefined;
if (callee.type === "Import" && moduleSpecifier) {
if (moduleSpecifier.type === "StringLiteral" && typeof moduleSpecifier.value === "string") {
dynamicImports.add(moduleSpecifier.value);
} else if (
moduleSpecifier.type === "TemplateLiteral" &&
Array.isArray(moduleSpecifier.expressions) &&
moduleSpecifier.expressions.length === 0 &&
Array.isArray(moduleSpecifier.quasis) &&
moduleSpecifier.quasis.length === 1
) {
const cooked = ((moduleSpecifier.quasis[0] as Record<string, unknown>).value as Record<string, unknown>)
?.cooked;
if (typeof cooked === "string") dynamicImports.add(cooked);
}
if (callee.type === "Import") {
addDynamicSpecifier(argumentsList[0] as Record<string, unknown> | undefined);
}
}
for (const value of Object.values(current)) {
Expand Down
4 changes: 3 additions & 1 deletion tests/client-secret-surface.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,9 @@ function localImports(file: string) {
const text = readFileSync(file, "utf8");
const source = parse(text, {
sourceType: "module",
plugins: ["jsx", "typescript", "importAttributes"],
// @babel/parser 8 parses import attributes by default; the standalone
// "importAttributes" plugin was removed (and is now a type error).
plugins: ["jsx", "typescript"],
});
const specifiers: string[] = [];
for (const statement of source.program.body) {
Expand Down
Loading