6 Dependabot alerts deliberately left open — what each one is waiting on

[radroid]

Tracking issue from the 2026-08-08 Dependabot cleanup (#52, #56, #57), which took the repo from 107 open alerts to 6. Each of the six was left open on purpose. Recording why, so none of them gets re-triaged from scratch or quietly dismissed.

Grouped by what would actually unblock them.

Nothing to bump — the fix does not exist

• image-size@1.2.1 — two high alerts, both with vulnerable range <= 2.0.2 and no patched version published. There is nothing to upgrade to. Re-check periodically; if a fix never lands, the question becomes whether whatever pulls it in can be dropped.

Waiting on a dependency this repo does not control

• @vitest/browser@4.1.9 → 4.1.10 (critical, dev-scoped). 4.1.10 declares an exact peer, "vitest": "4.1.10", so it cannot move alone — it drags @vitest/{expect,mocker,runner,snapshot,spy,utils,pretty-format} with it, and vitest here is supplied by vite-plus@0.2.2, which pins the family at 4.1.9. Bumping the test runner out from under the fork's only CI gate is not worth it for an advisory in Vitest Browser Mode, which no vite.config.ts in this repo configures. Unblocked by: the next vite-plus bump. Check this alert at that point.

• @hono/node-server@1.19.14 → 2.0.5 (medium, runtime). No 1.x fix exists. It arrives via @modelcontextprotocol/sdk@1.29.0, which declares "@hono/node-server": "^1.19.9". SDK 1.30.0 widens that to "^1.19.9 || ^2.0.5", and @anthropic-ai/claude-agent-sdk@0.3.170 already asks for ^1.29.0 — so 1.30.0 is inside the range its own dependant wants, and this looks like a two-line fix. It is not: the SDK is an auto-installed peer, so an overrides: entry rewrites the declared peer range and leaves the resolved instance at 1.29.0, and pnpm update --depth Infinity is a no-op because no workspace manifest declares the SDK. Landing it needs a full --force lockfile re-resolution. Attempted and reverted. Unblocked by: upstream bumping @anthropic-ai/claude-agent-sdk, or a sync that re-resolves the lockfile wholesale.

Deferred on risk, fixable any time we want to pay for it

• sharp@0.34.5 → 0.35.0 (high). A minor bump in 0.x is a breaking change by semver, and sharp is a native package with prebuilt binaries and an allowBuilds: true entry. Forcing it via overrides: risks the desktop build. Wants its own PR with a real desktop build behind it, not a lockfile edit.

• uuid@7.0.3 → 11.1.1 (medium). Four majors. It arrives on a path pnpm already flags as deprecated, so the honest fix is removing whatever still depends on uuid@7, not forcing 11 underneath a caller written against 7.

---

Reproduce the current list with:

gh api repos/radroid/t3code/dependabot/alerts --paginate \
  -q '.[] | select(.state=="open") | "\(.number) \(.security_advisory.severity) \(.dependency.package.name)"'

Note when checking these by hand: pnpm-lock.yaml single-quotes scoped package keys ( '@vitest/browser@4.1.9':), so a ^ @scope/name@ grep matches nothing and looks like the package is absent. That mistake is why the first pass on the two scoped alerts above was wrong.

The 41 alerts against .repos/** are dismissed as not_used and suppressed by .github/dependabot.yml — vendored subtrees, not code this fork builds. See the seam ledger rows 36 and 37 in docs/t3x/SEAMS.md for the pins that are now fork-owned.