chore(deps): resolve all 131 open Dependabot alerts - #119
Merged
Conversation
…anifests 131 open alerts, six manifests, all npm or pip (no Cargo alerts). front: next 16.2.1 -> 16.2.11, postcss ^8.5.23; nanoid and sharp via audit fix. demo: hono ^4.12.34, ws ^8.21.0, nodemailer ^6 -> ^9 (createTransport and sendMail are unchanged); esbuild and follow-redirects via update. inputlayer-js: ws ^8.21.0; vite, vitest, postcss, nanoid, picomatch via update; esbuild pinned to ^0.28.1 through an override because tsup's range still admits the vulnerable line. api-client: orval ^8.5 -> ^8.22 (two import-time RCEs and an SSRF); fast-uri, js-yaml, linkify-it, markdown-it, brace-expansion, picomatch via update; same esbuild override. inputlayer-py: idna, langchain-core, langchain-openai, langgraph-checkpoint, langgraph-sdk, langsmith, pytest, urllib3 relocked. langsmith's patched line needs websockets >= 15, so the bound widens to >=13,<16; the client already imports websockets.asyncio.client, which is the API that survives. Removed docs/site: a Nextra 2 skeleton with no pages directory and no lockfile, last touched in #69, referenced by nothing in CI or the Makefile (the live site is front/). It carried 15 Next.js 13 advisories no build would ever exercise. Removed packages/api-client/bun.lock: out of sync with package-lock.json, and nothing installs with bun. Verified: npm audit reports 0 vulnerabilities in all four npm packages; front builds; demo builds; inputlayer-js typechecks, builds, and passes 96 unit tests under Node 22; api-client builds; inputlayer-py passes 974 unit tests.
- front: Next pinned exactly at 16.3.4 (was loosened to a caret). 16.2.11 closes the Next advisories but vendors postcss 8.5.22 and depends on sharp 0.34, both still flagged; 16.3.x is the first line where the vendored copies are patched, and it is what the earlier build actually ran against. - demo, inputlayer-js, api-client: lockfiles rebuilt from main with only the flagged packages moved. Drops the unrelated @types/node 25 -> 26 and zod 3 -> 4 majors that a blanket npm update had swept in. Remaining majors are what the bumped packages themselves require (commander for orval 8.27) or were the alert (picomatch 2 -> 4). - demo: esbuild override, same reason as the other two (tsx's range still admits the vulnerable line). - vite in inputlayer-js resolved under Node 22: npm's engine check on Node 21 silently refused to move it past 7.3.1. - docs/README.md and .gitignore no longer mention the removed docs/site. Verified from clean installs: npm ci passes in all four packages; front builds; demo builds; inputlayer-js typechecks, builds, 96 tests pass under Node 22; api-client typechecks and builds; npm audit is 0 everywhere.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes every open Dependabot alert on the repo: 131 alerts across six manifests, all npm or pip. There were no Cargo alerts.
Next goes to 16.3.4 rather than 16.2.11 because 16.2.x vendors a postcss and depends on a sharp that are both still flagged; 16.3 is the first line where the vendored copies are patched.
The esbuild overrides exist because tsup's and tsx's dependency ranges still admit the vulnerable line, so
npm audit fixalone loops without resolving it.The websockets bound moved because langsmith's patched release requires websockets 15. The Python client already imports from
websockets.asyncio.client, which only exists from 13, so the old floor of 12 was already wrong and nothing in the client changes.Lockfiles were rebuilt from main with only the flagged packages moved, so no unrelated majors ride along. The remaining majors are what the bumped packages themselves require (commander for orval 8.27) or were the alert (picomatch 2 -> 4).
Removed
docs/site: a Nextra 2 skeleton with no pages directory and no lockfile, last touched in feat: LangChain integration for Python SDK #69, already labeled legacy in .gitignore, referenced by nothing in CI or the Makefile. The live site isfront/. docs/README.md and .gitignore updated to match.packages/api-client/bun.lock: out of sync with package-lock.json, and nothing installs with bun.Verified, from clean installs
npm cipasses in front, demo, inputlayer-js, api-clientnpm audit: 0 vulnerabilities in all fournpm run buildsucceeds on Next 16.3.4npm run buildsucceedsnpm run generatewas not re-run; the generated client is unchanged)Not verified
createTransportandsendMail, whose signatures did not change across 7, 8, or 9.🤖 Generated with Claude Code
https://claude.ai/code/session_013RS6fcjUiRnYMgjrXKLZ7f