Skip to content

Fix Dependabot security alerts for 3 dependencies#88

Merged
hackerwins merged 2 commits into
mainfrom
fix/dependabot-security-alerts
Mar 28, 2026
Merged

Fix Dependabot security alerts for 3 dependencies#88
hackerwins merged 2 commits into
mainfrom
fix/dependabot-security-alerts

Conversation

@hackerwins

@hackerwins hackerwins commented Mar 28, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

Add pnpm overrides to patch 31 Dependabot security alerts across 15 packages.

Commit 1 — 4 alerts fixed:

  • brace-expansion 5.0.4 → 5.0.5: process hang and memory exhaustion
  • yaml 2.7.1 → 2.8.3: stack overflow via deeply nested YAML
  • picomatch 4.0.2 → 4.0.4: ReDoS + method injection (×2 alerts)

Commit 2 — 24 more alerts fixed:

  • brace-expansion 1.1.11 → 1.1.12: ReDoS (×2 alerts)
  • on-headers < 1.1.0 → 1.1.0: HTTP response header manipulation
  • @eslint/plugin-kit < 0.3.4 → 0.3.4: ReDoS via ConfigCommentParser
  • js-yaml 3.14.1 → 3.14.2 & 4.1.0 → 4.1.1: prototype pollution (×2)
  • lodash 4.17.21 → 4.17.23: prototype pollution in unset/omit
  • diff 4.0.2 → 4.0.4: DoS in parsePatch/applyPatch
  • ajv 6.12.6 → 6.14.0 & 8.17.1 → 8.18.0: ReDoS with $data (×2)
  • multer 2.0.2 → 2.1.1: DoS via resource exhaustion/recursion (×3)
  • file-type 21.3.0 → 21.3.2: infinite loop + decompression bomb (×2)
  • undici 7.22.0 → 7.24.0: WebSocket overflow, CRLF injection, memory DoS (×6)
  • flatted 3.3.3 → 3.4.2: recursion DoS + prototype pollution (×2)
  • yauzl 3.2.0 → 3.2.1: off-by-one error
  • smol-toml 1.6.0 → 1.6.1: DoS via commented lines

3 alerts not fixable via overrides:

  • tmp 0.0.x → 0.2.x: breaking API change, deep in @nestjs/cli scaffolding (dev-only, low risk)
  • file-type 19.x → 21.x: major version jump, locked by @xhmikosr/downloader (dev-only)
  • esbuild: already at 0.25.2 (above patched 0.25.0), alert not auto-dismissed

Test plan

  • pnpm verify:fast passes (lint + all unit tests)
  • pnpm install succeeds with no errors
  • Verified patched versions via pnpm why

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Pinned multiple dependency versions across the project to improve stability and security; expanded resolution overrides to ensure consistent, safer installs.

@hackerwins @claude
Fix Dependabot security alerts for 3 dependencies
48512d8 
Patch transitive vulnerabilities via pnpm overrides:
- brace-expansion 5.0.4 → 5.0.5 (process hang, memory exhaustion)
- yaml 2.7.1 → 2.8.3 (stack overflow via deep YAML)
- picomatch 4.0.2 → 4.0.4 (ReDoS + method injection)

Co-Authored-By: Claude Opus 4.6 <[email protected]>
@coderabbitai

coderabbitai Bot commented Mar 28, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ec3b7097-d229-4c47-a9b6-ba9292eac8bc

📥 Commits

Reviewing files that changed from the base of the PR and between 48512d8 and 27d6e18.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • package.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • package.json
📝 Walkthrough

Walkthrough

Updated pnpm.overrides in package.json to add multiple new forced resolutions for various dependencies (e.g., brace-expansion, yaml, picomatch, lodash, undici, etc.) and retain the existing serialize-javascript override.

Changes

Cohort / File(s) Summary
Dependency overrides
package.json		 Expanded pnpm.overrides with numerous range-specific and exact pins: [email protected], [email protected], [email protected], plus pins for on-headers, @eslint/plugin-kit, js-yaml, lodash, diff, ajv, multer, file-type, undici, flatted, yauzl, smol-toml, and others; preserved [email protected] entry. Changes are confined to dependency resolution mappings.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰
I hopped through the lockfile, nose to the vine,
Pinned many a package, one tidy line by line,
No more surprise bumps on the dependency trail,
A carrot of stability — swift as a tail! 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Title check ⚠️ Warning The title claims to fix 3 dependencies, but the changeset actually addresses 27+ transitive vulnerabilities across many packages beyond the three mentioned. Update the title to accurately reflect the full scope: e.g., 'Fix Dependabot security alerts for multiple dependencies via pnpm overrides' or similar.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/dependabot-security-alerts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented Mar 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Verification: verify:self

Result: ✅ PASS in 117.5s

Lane Status Duration
sheets:build ✅ pass 13.1s
docs:build ✅ pass 5.9s
verify:fast ✅ pass 49.8s
frontend:build ✅ pass 15.1s
verify:frontend:chunks ✅ pass 0.3s
backend:build ✅ pass 4.4s
cli:build ✅ pass 1.9s
verify:entropy ✅ pass 26.9s

Verification: verify:integration

Result: ✅ PASS

@hackerwins @claude
Fix remaining 27 Dependabot security alerts via pnpm overrides
27d6e18 
Patch transitive vulnerabilities for:
- brace-expansion 1.x (ReDoS)
- on-headers (response header manipulation)
- @eslint/plugin-kit (ReDoS)
- js-yaml 3.x/4.x (prototype pollution)
- lodash (prototype pollution in unset/omit)
- diff (DoS in parsePatch/applyPatch)
- ajv 6.x/8.x (ReDoS with $data option)
- multer (DoS via resource exhaustion/recursion)
- file-type 21.x (infinite loop, decompression bomb)
- undici (WebSocket overflow, CRLF injection, memory DoS)
- flatted (recursion DoS, prototype pollution)
- yauzl (off-by-one error)
- smol-toml (DoS via commented lines)

3 alerts cannot be resolved via overrides:
- tmp 0.0.x (API breaking change to 0.2.x)
- file-type 19.x (major version jump to 21.x)
- esbuild (already at 0.25.2, above patched 0.25.0)

Co-Authored-By: Claude Opus 4.6 <[email protected]>
@hackerwins
hackerwins merged commit bc2de24 into main Mar 28, 2026
3 checks passed
@hackerwins
hackerwins deleted the fix/dependabot-security-alerts branch March 28, 2026 02:30
@coderabbitai coderabbitai Bot mentioned this pull request May 24, 2026
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hackerwins