Bump deps and pnpm overrides to clear 22 Dependabot alerts#294
Conversation
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 35 minutes and 29 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (13)
📝 WalkthroughWalkthroughRoot pnpm.overrides configuration updated with revised and expanded transitive dependency constraints; direct dependency versions bumped for ChangesDependabot Alerts Resolution
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/tasks/active/20260525-dependabot-alerts-todo.md`:
- Around line 27-57: The task file's plan checklist under headings "A. Update
stale `pnpm.overrides` entries", "B. Add new `pnpm.overrides`", "C. Direct
dependency bumps", and "D. Verify" is inconsistent with the overall status
(`status: done`)—update each checklist item from `[ ]` to `[x]` (or prepend a
short note like "Historical plan - completed") so the entries match the `status:
done` summary and avoid ambiguity; locate and edit the checklist lines under
those exact headings to flip all unchecked boxes to checked.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2d15d91e-f553-41bf-b85c-41df165b2c22
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (10)
docs/tasks/README.mddocs/tasks/active/20260525-dependabot-alerts-lessons.mddocs/tasks/active/20260525-dependabot-alerts-todo.mddocs/tasks/archive/README.mdpackage.jsonpackages/backend/package.jsonpackages/docs/package.jsonpackages/frontend/package.jsonpackages/sheets/package.jsonpackages/slides/package.json
Verification: verify:selfResult: ✅ PASS in 250.2s
Verification: verify:integrationResult: ✅ PASS |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
GitHub Dependabot reported 22 open alerts (6 high, 14 medium, 2 low), all npm transitive deps surfaced through the lockfile. Several existing pnpm.overrides had gone stale: they pinned a version that since received its own advisory (lodash 4.17.23, serialize-javascript 7.0.3, brace-expansion 1.1.12/5.0.5), and a few ranges were too narrow to cover all installed copies (file-type 19.x, picomatch 2.x, brace-expansion 2.x). Update those overrides, add overrides for newly-flagged packages (fast-uri, fast-xml-builder, fast-xml-parser, path-to-regexp, tmp, esbuild, postcss, qs), bump vite to ^6.4.2 in the four app packages plus a scoped vite override so vitest's copy moves too, and pull @nestjs/core 11.1.18. lodash is pinned to 4.18.1, not the advisory's 4.18.0, because npm deprecates 4.18.0 as a bad release. A lockfile scan confirms no vulnerable version remains for any of the 22 advisories. verify:fast, pnpm build, and the vitepress docs build all pass. [email protected] stays via vitepress 1.x (dev-only, not among the 22). Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
46b43f1 to
2fd3fe4
Compare
Both tasks' work has landed on main: the Vitest migration merged as #291, and the @wafflebase/tokens deploy fixes (publish-ghpage.yml build:all + Dockerfile tokens build) are present on main, absorbed into #292. Their only open todo items were trailing 'open PR / code review' process steps, now ticked, so pnpm tasks:archive moves both to archive/2026/05 and regenerates the index. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The 22-alert remediation is complete and verified in this branch (PR #294); tick the remaining plan checkboxes and move the todo/lessons to archive/2026/05 so the active task list reflects only in-flight work. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The v0.4.2 release Docker build exceeded GitHub's 6-hour job limit and was cancelled, while normal main-push builds finished in ~3 minutes. The workflow built linux/amd64,linux/arm64 in one job on an amd64 runner, so arm64 was produced under QEMU emulation. The Dockerfile builder stage is pinned to $BUILDPLATFORM (native), but the runtime stage is not, so the arm64 'pnpm install --prod' and 'npx prisma generate' ran emulated. These were normally inline-cache hits; the preceding dependency bump (#294/#295) rewrote pnpm-lock.yaml and package.json, invalidating the cache and forcing the emulated steps to execute for the first time -> 6h timeout. Build each platform on its own native runner (ubuntu-24.04 / ubuntu-24.04-arm, free on this public repo), push by digest, and merge a multi-arch manifest. Replace the broken type=inline cache with type=gha,mode=max scoped per arch, and add timeout-minutes so a hang fails fast instead of burning 6h. Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
1 participant
Summary
Resolves all 22 open Dependabot alerts (6 high, 14 medium, 2 low) — all npm transitive deps surfaced through
pnpm-lock.yaml.Root cause was twofold:
pnpm.overridesthat pinned a version which has since received its own advisory:lodash4.17.23,serialize-javascript7.0.3,brace-expansion1.1.12 / 5.0.5.file-type19.6.0,picomatch2.x,brace-expansion2.x lines slipped through.Changes
lodash→ 4.18.1 (not 4.18.0 — npm deprecates 4.18.0 as a bad release),serialize-javascript→ 7.0.5,brace-expansion→ 1.1.13 / 2.0.3 / 5.0.6, broadenedfile-type(<21.3.2) andpicomatch(<2.3.2).fast-uri3.1.2,fast-xml-builder1.1.7,fast-xml-parser5.7.0,path-to-regexp8.4.0,tmp0.2.4,esbuild0.25.0,postcss8.5.10,qs6.15.2.vite^6.4.1→^6.4.2(frontend, docs, sheets, slides) + a scopedvite@>=6.0.0 <6.4.2override so vitest's own copy moves;@nestjs/core→ 11.1.18.A lockfile scan confirms zero vulnerable versions remain for any of the 22 advisories.
Known limitation
[email protected]remains viavitepress 1.6.4(dev-only docs-site builder). The vite advisory range nominally covers it, but it was not among the 22 flagged alerts and can't move to vite 6 without a vitepress major upgrade. Tracked as a follow-up.Test plan
pnpm verify:fast→ green (frontend 38, backend 401, sheets 1274, slides 1296, cli 191, docs 792)pnpm build→ all packages buildpnpm documentation build→ vitepress builds with esbuild 0.25 forced into its vite 5 (riskiest override verified)🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores