Repository navigation
fix(deps): patch vulnerable frontend transitive dependencies - #41
Merged
Merged
Conversation
Pin fixed versions of form-data, ws, brace-expansion, minimatch, picomatch, glob, js-yaml, flatted, browserslist, Babel and others through bounded pnpm overrides that stay inside each parent's major. Bump eslint and tailwindcss within range, and drop the unused @hookform/resolvers dependency. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YPDRcAu87qM3sf5WRoPWY6
12 of 22 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before:
pnpm auditon the web app reported 73 advisories (3 critical, 41 high).After: 21 remain, and all of them sit under
@hey-api/openapi-ts0.83 (handlebars, tar, and the tool itself). Those go away with the openapi-ts upgrade in the next PR. This PR fixes the critical form-data alert along with ws, brace-expansion, minimatch, picomatch, glob, js-yaml, flatted, browserslist, Babel, @humanfs/node, @eslint/plugin-kit, diff, yaml, lodash and postcss-selector-parser.Motivation and Context
GitHub flags 104 vulnerable dependencies on main. Most of them are transitive dev dependencies.
How: bounded
overridesinpnpm-workspace.yaml. Each override keeps a package inside the major version its parent asks for (for examplebrace-expansion@^1: ^1.1.21). eslint and tailwindcss are bumped within their existing ranges.@hookform/resolversis removed because nothing imports it, which replaces Dependabot #34.Types of changes
Checklist:
make hookschecks it on commit).## UnreleasedinCHANGELOG.md.Checked locally, since no runner is available:
tscis clean, eslint is clean, Prettier check passes, Jest passes 535/535 (withNODE_ENV=test),next buildsucceeds,pnpm@10.7.1 install --frozen-lockfileworks on the lockfile, and the pre-commit hooks pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01YPDRcAu87qM3sf5WRoPWY6
Generated by Claude Code