Conversation
Three alerts, none of which reached a runtime surface, but all with a cheap fix: - sharp 0.34.5 -> 0.35.2 (GHSA-f88m-g3jw-g9cj, high): inherited libvips CVEs. sharp is not a direct dependency — it comes in transitively via miniflare, whose pin only moves with wrangler, so bump wrangler 4.112.0 -> 4.114.0 (dev-only, never in the deployed site bundle). - react-router-dom 6.30.4 -> 7.18.1 (CVE-2026-53666/53668/53669): the 6.x line has no patch, 6.30.4 is its last release. Deliberately NOT the 7.0.0 that Dependabot proposed in #196 — 7.0.0 carries eight HIGH advisories fixed only in 7.5.2 … 7.18.0 plus a vulnerable turbo-stream, i.e. it trades three moderates for eight highs. 7.18.1 keeps peer react >=18, so React stays on 18 and no application code changes: the dashboard only uses BrowserRouter, Routes, Route, Navigate, Link, NavLink, useNavigate, useParams and useSearchParams, all unchanged in v7. tsc -b and vite build are clean. - brace-expansion 2.1.0 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp, high ReDoS): transitive dev dep via minimatch, in range, so a plain npm update. Known remainders, both without a non-breaking fix and neither reachable in this codebase: - GHSA-mh99-v99m-4gvg (brace-expansion OOM) is patched only in 5.0.8, while minimatch@5 — pinned by @redocly/openapi-core, itself pinned by openapi-typescript — requires ^2.0.1. An override to 5.x would break the toolchain: brace-expansion 5's CJS entry exports { expand } rather than a callable default, and minimatch calls the module directly. Only consumer is the gen:api codegen over our own doc/openapi.yaml. - GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass) is patched only in 8.3.0, which requires react >=19.2.7 — a major React bump that stays deferred. The dashboard is a Vite SPA with BrowserRouter and no RSC/SSR, so the advisory does not apply. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
chore(deps): clear the open Dependabot security alerts (supersedes #196)
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes #213 to
main.Clears the five open Dependabot alerts (#23, #24, #25, #26, #27):
sharp(GHSA-f88m-g3jw-g9cj)wrangler4.112.0 → 4.114.0 (sharp is transitive viaminiflare)brace-expansion(GHSA-3jxr-9vmj-r5cp)npm update, in rangereact-router/react-router-domThe alerts are computed from the default branch, so they only close once this lands on
main.Deliberately not the react-router 7.0.0 that Dependabot proposed in the now-closed #196: 7.0.0 carries eight HIGH advisories fixed only in 7.5.2 … 7.18.0 plus a vulnerable
turbo-stream, which is why theTrivycheck failed there. On this head the same check passes.No application code changed — the dashboard's react-router surface (
BrowserRouter, Routes, Route, Navigate, Link, NavLink, useNavigate, useParams, useSearchParams) is identical in v7, andreact >=18remains the peer requirement so React stays on 18. Verified locally:npm run typecheck,tsc -b && vite build(dashboard),vite build(site), andnpm auditclean insite/.Green on the head SHA:
Trivy,Trivy (filesystem),govulncheck (server),govulncheck (cli),CodeQL,Analyze (go),Analyze (actions),test,Build site.Two remainders documented in #213, neither with a non-breaking fix nor reachable here: GHSA-mh99-v99m-4gvg (
brace-expansionOOM — patched only in 5.0.8, unreachable behindminimatch@5, and an override breaks the toolchain) and GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF — patched only in 8.3.0, which needs React 19; the dashboard is a Vite SPA with no RSC/SSR).Note the
sitebump touches only dev tooling (wrangler/miniflare), so the deployed site is unaffected; the react-router fix ships to users with the next server release, since the dashboard is embedded in the image.🤖 Generated with Claude Code