fix(deps): raise security-floor overrides for 17 dependabot alerts - #1939
Merged
Conversation
All eight affected packages are transitive; seven already had security-floor overrides that new advisories had outgrown, so each floor moves up rather than a new override being added. js-yaml ^3.15.0 -> ^3.15.1 (3.15.1) ip-address >=10.1.1 -> >=10.3.1 (10.5.0) undici >=7.28.0 <8 -> >=7.29.0 <8 (7.29.0) fast-uri >=4.1.1 -> >=4.1.2 (4.1.2) postcss >=8.5.10 -> >=8.5.23 (8.5.26) hono >=4.12.27 -> >=4.12.34 (4.13.3) @hono/node-server >=1.19.13 -> >=1.19.15 <2 (1.19.17) @hono/node-server gains a `<2` cap. Its old floor held 1.19.13 only because pnpm leaves an already-locked version alone while it still satisfies its spec; moving the floor forces re-resolution, and an open range would have silently landed 2.x (a major that also raises the Node floor to >=20). Fixes: ip-address CVE-2026-69192, CVE-2026-69198, CVE-2026-54272 undici CVE-2026-13697, CVE-2026-15157, CVE-2026-16729, CVE-2026-14643, CVE-2026-16728 hono CVE-2026-71849, CVE-2026-71850, CVE-2026-71848, CVE-2026-69207 postcss CVE-2026-73646, CVE-2026-69153 fast-uri CVE-2026-18446 js-yaml GHSA-5p4m-2wfm-xmqj @hono/node-server GHSA-frvp-7c67-39w9 Not fixed: sharp (GHSA-f88m-g3jw-g9cj, high). The fix needs 0.35.0, but its only parent -- @huggingface/transformers@4.2.0, already the latest release -- hard-depends on `sharp: ^0.34.5`, and 0.x-minor bumps are breaking by sharp's own convention. Left for upstream. Exposure is nil in practice: sharp is never imported by repo source, transformers runs in a browser worker on onnxruntime-web (the Node sharp backend never loads), and apps/docs is private. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
misama-ct
added
dependencies
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Bundle Size ReportLast updated: 2026-08-24 07:27:47 UTC
Baseline source: comment-chain |
|
Tip All tests passed and all changes approved!🟢 UI Tests: 1207 tests unchanged |
github-actions
Bot
added
the
bundle-sizes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves 17 of 18 open Dependabot alerts. All eight affected packages are transitive, and seven of them already had security-floor overrides in
pnpm-workspace.yamlthat newer advisories had outgrown — each was resolving at exactly its floor. So this raises floors rather than adding overrides. No source files change.js-yaml^3.15.0^3.15.1ip-address>=10.1.1>=10.3.1undici>=7.28.0 <8>=7.29.0 <8fast-uri>=4.1.1>=4.1.2postcss>=8.5.10>=8.5.23hono>=4.12.27>=4.12.34@hono/node-server>=1.19.13>=1.19.15 <2🔒 Vulnerabilities fixed
ip-addressundicifast-uripostcsssourceMappingURLpath traversaljs-yaml!!omapresolutionhono@hono/node-serverserve-staticpath traversal on Windows@hono/node-servergains a<2cap — this is load-bearing, not stylistic.Its old floor held 1.19.13 only because pnpm leaves an already-locked version alone while it still satisfies its spec. Moving the floor forces re-resolution, and
@hono/node-server2.x exists — so an open>=1.19.15would have silently landed 2.1.1, a major bump that also raises the Node engine floor to>=20. The cap keeps this a security patch instead of a stealth major.I checked every other bumped package for the same trap: none has a newer major an open floor could reach (
undiciwas already capped<8;js-yaml's caret holds the 3.x line).All seven target versions clear the repo's
minimumReleaseAge: 1440gate (oldest 441h), sominimumReleaseAgeStrict: truewon't fail resolution.⏭️ Not fixed — left for upstream
sharp@huggingface/transformers@4.2.0, already the latest release — hard-depends onsharp: ^0.34.5. An override would violate that constraint, and 0.x-minor bumps are breaking by sharp's own convention.Exposure is nil in practice:
sharpis never imported by repo source,@huggingface/transformersruns in a browser web worker ononnxruntime-web(the Nodesharpimage backend never loads), andapps/docsisprivate: true. The advisory covers inherited libvips image-decoding CVEs.🧹 Overrides audit
Audited all 45 override entries against the lockfile. 44 are actively resolving a version — kept. One dormant entry found:
"happy-dom@<20.8.9": ">=20.8.9"— happy-dom is never installed; it exists only as an optional peerDependency of vitest (native range*). Deliberately left in place as a forward guard; removing it is unrelated churn for a security PR.✅ Validation
Run on this branch after
pnpm install:pnpm lint— 0 errors (2 pre-existing warnings in untouched files)pnpm build— full token → packages → docs build, exit 0pnpm typecheck:strict— the CI gate, all 8 packages, exit 0pnpm test— 250 test files / 3225 tests passedbuildran beforetypecheck:strictbecause the strict check resolves@commercetools/nimbustodist; it also exercises the build-critical postcss bump.Lockfile diff contains only the 7 targets plus
nanoid 3.3.11 → 3.3.18(postcss's own dependency). Everything else is peer-hash re-keying.No changeset: overrides are workspace-local and don't alter any published package's declared dependencies, so there is no consumer-visible change.
📋 Review checklist
<2cap on@hono/node-serveris the desired call vs. taking 2.x deliberately in a separate PRsharpto upstream is acceptable given the nil-exposure argumenthono4.12.31 → 4.13.3 (minor, within major) for anything affectingnimbus-mcp🤖 Generated with Claude Code