Repository navigation
build(deps): close the frontend's open security alerts - #300
Merged
Merged
Conversation
Raise pnpm overrides for handlebars (4.7.10), file-type (21.3.1), katex (0.18.2) and postcss-selector-parser (7.1.6), and leave argparse out of js-yaml 3, which needs it only for its own command line, so sprintf-js (no fixed release) is gone. The three new majors keep the API their parents call: Tailwind's CSS is byte-identical, KaTeX's MathML output is unchanged and file-type still detects from a buffer. braces (GHSA-vfj7-8cjw-p6xm) has no fixed release and stays, through Tailwind 3 and eslint-config-next. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017H7VU5LssSNh2wspwR3qik
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before:
pnpm auditinnextjs-frontendreported 8 advisories (2 critical, 1 high, 4 moderate, 1 low), the open Dependabot alerts. The backend (pip-audit, PyPI and OSV), the web clipper (npm audit) and the GitHub Actions in use had none.After: one is left, braces (GHSA-vfj7-8cjw-p6xm), which has no fixed release.
How: pnpm overrides in
pnpm-workspace.yaml, like #41.Three of these needed a newer major than the parent asks for, so each was checked against what the parent calls:
app/globals.cssis byte-identical before and after (98,285 bytes).output: 'mathml'. The MathML for five sample equations (fractions, roots, sums, matrices, integrals) is identical between 0.16.47 and 0.18.10. The 0.18 CSS class prefixing doesn't touch MathML output.fileTypeFromBuffer, which 21 still exports from both its node and browser entries. It detects a PNG header correctly.js-yamlcommand line, which nothing runs. The override"js-yaml@^3>argparse": "-"drops it. js-yaml 3 still loads, andpnpm coverage(which loads the nyc config through it) passes.Left open: braces ≤ 3.0.3 (GHSA-vfj7-8cjw-p6xm, stack exhaustion from deeply nested brace patterns). There's no fixed release (upstream issue micromatch/braces#70). It comes in through Tailwind 3 (chokidar, fast-glob, micromatch) and
@next/eslint-plugin-next, which pins fast-glob 3.3.1 even on canary. Both are build-time only and expand glob patterns from our own config, never user input. Dependabot will raise the fix once braces ships one.Motivation and Context
Open Dependabot security alerts.
Types of changes
!in the title)Checklist:
make hookschecks it on commit).build(deps)title lists it under Dependencies.Done questions (AGENTS.md)
.envedit or manual step.pnpm install. lint, tsc, jest and coverage pass locally.🤖 Generated with Claude Code
https://claude.ai/code/session_017H7VU5LssSNh2wspwR3qik
Generated by Claude Code