chore(deps): fix 18 of 32 Dependabot alerts via bumps and overrides#140
Merged
Conversation
Root workspace: - npm audit fix: js-yaml -> 3.15.0 / 4.3.0 (GHSA-52cp-r559-cp3m, GHSA-mh29-5h37-fv8m, GHSA-h67p-54hq-rp68), picomatch -> 2.3.2 (GHSA-3v7f-55p6-f55p), brace-expansion -> 2.1.2 (GHSA-3jxr-9vmj-r5cp). - overrides: brace-expansion ^2.1.2 (was ^2.0.3, a 2.0.1 pocket remained), esbuild ^0.25.0 (forces the 0.21.5/0.23.1 copies under vite5 and @jspsych/config past GHSA-67mh-4wv8-2f99). - frontend: vite 5.4 -> 6.4.3 + @vitejs/plugin-react-swc ^4.3.1 (three vite advisories; range covered 5.x). No code changes needed. Website (separate lockfile): - overrides: serialize-javascript ^7.0.5 (GHSA-5c6j-r48x-rmvq RCE, GHSA-qj8w-gfj5-8c6v DoS), uuid ^11.1.1 (GHSA-w5hq-g745-h8pq). Docusaurus production build verified. Not fixed here (documented, needs upstream or dismissal): - undici 5.28.4 (11 alerts): pinned exactly by psychds-validator; no patched 5.x for most advisories, override to 6.x breaks npm's tree. Needs an upstream psychds-validator release. - tmp 0.0.33 (2 alerts): external-editor pins ^0.0.33; no compatible patched release. Dev-only (interactive editor prompts). - vue-template-compiler (1 alert): no patch exists; dev-only, pulled in by @jspsych/config via alias-hq; vulnerable code path unused. Verified: 730 tests, typecheck, lint, all package builds, and the website production build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 7a0b35e The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Triage of the 32 open Dependabot alerts (10 high / 18 moderate / 4 low). This PR fixes 18; the remaining 14 cannot be fixed here and are itemized below with recommended dispositions.
Fixed in this PR (18 alerts)
npm audit fix→ 3.15.0 / 4.3.0^2.1.2(a 2.0.1 pocket underfilelistsurvived the old override)^0.25.0(forces the 0.21.5 / 0.23.1 copies under vite 5 and@jspsych/config)@vitejs/plugin-react-swc^4.3.1 — the advisory ranges (<= 6.4.2) covered our 5.4.21. No code changes needed; all 730 tests + build pass^7.0.5; Docusaurus production build verified^11.1.1(under sockjs/webpack-dev-server)Not fixable here (14 alerts) — recommended dispositions
psychds-validator@1.5.1(its latest release). Most advisories have no patched 5.x; forcing 6.x via override breaks npm's dependency tree resolution, and an override wouldn't protect published CLI users anyway. Recommend: file an upstream issue asking psychds-validator to bump undici, and track these against that. Practical exposure is low: undici is used for the validator's schema fetches to fixed URLs; the high-severity vectors are WebSocket-specific, which the validator does not use.external-editor(under inquirer's editor prompt) pins^0.0.33; no compatible patched release exists. Dev-scope, only reachable via interactive editor prompts on the developer's own machine. Recommend: dismiss as "vulnerable code not in use / tolerable risk".@jspsych/config→ alias-hq → vue-jscodeshift-adapter; we never compile Vue templates, let alone from untrusted input. Recommend: dismiss as "vulnerable code not in use".Verification
docusaurus buildincl. wizard embed) succeeds with serialize-javascript 7 / uuid 11🤖 Generated with Claude Code