Patch Dependabot-flagged dependency vulnerabilities - #73
Conversation
Bumps js-yaml to 5.4.1 (fixes quadratic/exponential DoS in both the 3.x and 4.x lines used transitively via jest/gray-matter, alerts 351/354/335) and adds pnpm/npm overrides to pull in patched versions of hono, @hono/node-server, fast-uri, ip-address, brace-expansion, @opentelemetry/core, uuid (root), and nanoid, undici, jsondiffpatch (transmit/) - all transitive deps with no direct usage in our code. Two low/high alerts have no upstream fix yet and are left open: - extract-zip (via puppeteer) - GHSA-jmr9-qjv8-65gv has no patched version as of 2.0.1, the latest release. - @ai-sdk/provider-utils <=3.0.97 - GHSA-866g-f22w-33x8 has no patched release in the 3.x line; fixing requires a major ai SDK bump (v4->v7 in transmit/), out of scope for a dependency-patch PR.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 523157d572
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "handlebars": "4.7.9", | ||
| "protobufjs": "7.6.5" | ||
| "protobufjs": "7.6.5", | ||
| "js-yaml": "^5.4.1", |
There was a problem hiding this comment.
Whenever a TypeScript script parses QMD frontmatter, this override also replaces gray-matter@4.0.3's declared js-yaml@^3.13.1. That version of gray-matter binds yaml.safeLoad and yaml.safeDump during module initialization, but js-yaml 5 no longer exports either function, so scripts such as validate-frontmatter.ts and scripts/lib/file-utils.ts fail after a clean install. Upgrade or patch gray-matter, or restrict the override to consumers compatible with js-yaml 5.
Useful? React with 👍 / 👎.
| "@hono/node-server": "^1.19.15", | ||
| "fast-uri": "^3.1.5", | ||
| "ip-address": "^10.3.1", | ||
| "brace-expansion": "^5.0.9", |
There was a problem hiding this comment.
On a clean install, this global override rewrites minimatch@3.1.5's dependency from brace-expansion 1 to version 5. Minimatch 3 expects require('brace-expansion') itself to be callable, while brace-expansion 5's CommonJS entry exports a namespace object, so any brace pattern such as **/*.{js,ts} throws TypeError: expand is not a function. The Jest and glob 7 dependency trees still use minimatch 3, so their coverage, exclusion, or file-selection paths can fail; scope the override to compatible minimatch versions instead.
Useful? React with 👍 / 👎.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe root manifest upgrades ChangesDependency version pinning
Estimated code review effort: 1 (Trivial) | ~5 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
js-yamlto 5.4.1, fixing quadratic/exponential-time DoS advisories that hit both the 3.x line (transitive via jest's@istanbuljs/load-nyc-config) and the 4.x line (direct + transitive viagray-matter) — Dependabot alerts #351, #354, #335.pnpm.overridesin rootpackage.jsonto pull in patched, purely-transitive dependencies:hono,@hono/node-server,fast-uri,ip-address,brace-expansion,@opentelemetry/core,uuid— alerts #348, #341, #350, #349, #355, #346, #340, #339, #343, #342, #337, #182, #170.overridesintransmit/package.jsonfornanoid,undici,jsondiffpatch— alerts #357, #353, #347, #345, #344, #83.pnpm why/npm ls); this is a lockfile-only patch.Left open (no fix available)
puppeteer→@puppeteer/browsers) — GHSA-jmr9-qjv8-65gv has no patched release; 2.0.1 is latest and still vulnerable.aiSDK to a new major (v7 intransmit/), which is a real migration, not a lockfile patch.Test plan
pnpm auditon root: down to the 1 unfixable high (extract-zip) + 1 unfixable low (@ai-sdk/provider-utils).npm auditintransmit/: down to 5 unfixable lows, all the same @ai-sdk/provider-utils chain.js-yamlv5load/dumpAPI compatibility with a smoke test; nosafeLoad/safeDumpusage anywhere in the codebase.pnpm exec pyright dih_models scriptsclean; full pre-commit hook (Pyright + pre-render validation + artifact regeneration) passed.🤖 Generated with Claude Code
Summary by CodeRabbit