chore: update vulnerable dependencies#607
Merged
Merged
Conversation
nicholasjjlim
added
the
skill:aif-update-npm-dependencies
Resolve all 20 Dependabot advisories (4 high, 12 moderate, 4 low). Most were stale-lockfile artifacts: a fresh pnpm resolution (bounded by the existing minimumReleaseAge: 10080 cooldown) lands on patched, >=7-day-old versions without needing overrides. Direct dependency bumps: - vite ^7.3.2 -> ^7.3.5 (fs.deny bypass; launch-editor NTLM leak) - dompurify ^3.4.0 -> ^3.4.11 (multiple IN_PLACE / config-pollution XSS) Fixed by fresh resolution alone (verified via pnpm why): - @grpc/grpc-js -> 1.14.4 (weaviate-client>nice-grpc) - hono -> 4.12.27 (prisma>@prisma/dev>@hono/node-server) - protobufjs -> 7.6.4 (@valkey/valkey-glide, @grpc/proto-loader) - js-yaml -> 4.2.0 (eslint>@eslint/eslintrc) Override retained (genuinely load-bearing): - esbuild ^0.28.1 (dev-server file read) - tsx and vite cap esbuild at 0.25.x Stale-override cleanup: removed 10 overrides that natural resolution now satisfies on its own (hono, protobufjs, @grpc/grpc-js, js-yaml, fast-xml-builder, fast-uri, devalue, postcss, ws, minimatch>brace-expansion). Kept the 5 that are still load-bearing: @hono/node-server, fast-xml-parser, esbuild, cookie, exceljs>uuid (each reintroduces an advisory if removed). Audit clean (0 vulnerabilities); svelte-check clean; 361 tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
nicholasjjlim
force-pushed
the
fix/update-vulnerable-deps
branch
from
July 1, 2026 02:50
48f5ed2 to
2ee8898
Compare
nicholasjjlim
marked this pull request as ready for review
July 1, 2026 02:56
santosral
approved these changes
Jul 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Summary
Resolves all 20 Dependabot advisories on
main(4 high, 12 moderate, 4 low).Investigation showed most failures were a stale lockfile, not missing overrides: a fresh
pnpmresolution — bounded by the existingminimumReleaseAge: 10080(7-day) cooldown inpnpm-workspace.yaml— lands on patched, ≥7-day-old versions on its own. So this PR fixes the advisories with the minimum blast radius and prunes stale overrides.✏️ Changes
Direct dependency bumps
vite^7.3.2→^7.3.5—server.fs.denybypass (HIGH); launch-editor NTLMv2 disclosure (MOD). Cooldown correctly holds it at aged7.3.5, not the too-fresh7.3.6.dompurify^3.4.0→^3.4.11— multiple IN_PLACE / hook & config-pollution XSS bypassesFixed by fresh resolution alone (no override needed — verified with
pnpm why)@grpc/grpc-js→1.14.4(HIGH×2) ·weaviate-client > nice-grpchono→4.12.27(HIGH + MOD) ·prisma > @prisma/dev > @hono/node-serverprotobufjs→7.6.4(MOD) ·@valkey/valkey-glide,@grpc/proto-loaderjs-yaml→4.2.0(MOD) ·eslint > @eslint/eslintrcOverride retained (genuinely load-bearing)
esbuild^0.28.1— dev-server arbitrary file read (LOW).tsxandviteboth cap esbuild at0.25.x, so an override is the only way to reach the patch.🧹 Stale-override cleanup
Ran the skill's Step 7 check (remove → reinstall → re-audit) across all overrides. Overrides went 12 → 5. Removed 10 that natural resolution now satisfies unaided:
hono,protobufjs,@grpc/grpc-js,js-yaml,fast-xml-builder(was a no-op — not in the tree),fast-uri,devalue,postcss,ws,minimatch>brace-expansion.Kept the 5 that each reintroduce an advisory when removed:
@hono/node-server(>=1.19.13),fast-xml-parser,esbuild,cookie,exceljs>uuid.✅ Verification
pnpm audit→ 0 vulnerabilities (was 4 high / 12 moderate / 4 low)pnpm whypnpm check→ 0 errors, 0 warningspnpm test run→ 361 tests pass (43 files)🤖 Generated with aif-update-npm-dependencies