chore(deps): remediate 22 Dependabot alerts via pnpm overrides - #1341
Closed
BYK wants to merge 1 commit into
Closed
Conversation
Direct dep bumps: - @hono/node-server ^1.19.14 -> ^2.0.5 (closes #304) - react-router-dom ^7.17.0 -> ^7.18.0 (closes #314 #315 #316 #319) pnpm overrides raised to patched floors: - tar >=7.5.21 (closes #297 #298 #299 #300 #321) - brace-expansion 2.x line -> 2.1.3 (closes #323 2.x path) - js-yaml >=4.3.0 (closes #295) - shell-quote >=1.9.0 (closes #296) - postcss >=8.5.18 (closes #320) - fast-uri >=3.1.4 (closes #311 #313) - sharp >=0.35.0 (closes #312) - svgo >=4.0.2 (closes #305) - body-parser >=2.3.0 (closes #303) - builder-util-runtime >=9.7.0 (closes #318) - app-builder-lib >=26.15.0 (closes #317) - @hono/node-server >=2.0.5 (forces SDK transitive pin up) The 5.x brace-expansion line (@vercel/nft -> glob@13) was eliminated via override glob@>=13.0.0 -> 10.4.5, avoiding brace-expansion@5.0.8 which is ESM-only and breaks Vite config loading. Verification: - pnpm install clean - pnpm --filter website build: 29 pages - pnpm --filter @spotlightjs/spotlight build: renderer+main succeed - 215 unit tests pass Still open (out of scope here): - #301 #302: astro < 7.0.6 (needs vite 8, separate Astro 7 / Vite 8 PR) - #322: react-router RSC CSRF, patched only in react-router-dom@8.3.0 which is not yet published (7.18.1 stays < 8.3.0)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| "fast-uri": ">=3.1.4", | ||
| "ip-address": ">=10.1.1", | ||
| "lodash": ">=4.18.0", | ||
| "@xmldom/xmldom": ">=0.8.13", |
There was a problem hiding this comment.
Bug: The open-ended pnpm override for @xmldom/xmldom resolves to a version with a breaking API change, which will cause the build:mac command to fail.
Severity: CRITICAL
Suggested Fix
Update the pnpm override in package.json to include an upper bound, preventing resolution to the breaking version. Change '@xmldom/xmldom': '>=0.8.13' to '@xmldom/xmldom': '>=0.8.13 <0.9'.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: package.json#L57
Potential issue: The pnpm override for `@xmldom/xmldom` is an open-ended range
`'>=0.8.13'`, which allows resolution to version `0.9.10`. This version introduced a
breaking change requiring a `mimeType` argument for the `parseFromString()` function. A
transitive dependency, `plist@3.1.0` (used by `app-builder-lib` for macOS builds), calls
this function without the required argument. This will cause a `"DOMParser: mimeType
undefined is not valid"` runtime error, breaking the `build:mac` process.
Did we get this right? 👍 / 👎 to inform future reviews.
| @@ -45,22 +45,28 @@ | |||
| "cookie": ">=0.7.0", | |||
| "esbuild": ">=0.28.1", | |||
| "brace-expansion": ">=2.1.0 <3", | |||
There was a problem hiding this comment.
Bug: The pnpm override for brace-expansion forces an incompatible major version (2.x), breaking a dependency (minimatch@10.x) that requires version 5.x and causing the macOS build to fail.
Severity: CRITICAL
Suggested Fix
Update the pnpm override in package.json to be less restrictive, allowing different major versions to coexist. The analysis suggests using per-major-version ranges instead of a single blanket override to satisfy all dependencies.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: package.json#L47
Potential issue: A blanket pnpm override forces `brace-expansion` to version `2.x`
(`>=2.1.0 <3`). However, a dependency `app-builder-lib@26.15.7` requires
`minimatch@10.2.5`, which in turn requires `brace-expansion@^5`. The `minimatch` package
attempts to use a named export `expand` from `brace-expansion`, but version `2.x` only
provides a default export. This mismatch will cause a `TypeError: (0,
brace_expansion_1.expand) is not a function` during the `build:mac` process, causing the
build to fail.
Did we get this right? 👍 / 👎 to inform future reviews.
BYK
added a commit
that referenced
this pull request
Jul 28, 2026
Closes Dependabot alerts: #290, #291, #292, #293, #295, #296, #297, #298, #299, #300, #301, #302, #303, #304, #305, #311, #312, #313, #314, #315, #316, #317, #318, #319, #320, #321, #323. Consolidates the work that was previously split across #1341 and #1342: both PRs re-introduced the brace-expansion/minimatch@10 and @xmldom/xmldom regressions that were fixed in #1337. This PR adds the fix on top of origin/main, with a per-major brace-expansion override covering 1.x/2.x/3.x/4.x AND a 5.x line force to >= 5.0.8 (closes #323 fully; the ESM/CJS interop issue with 5.0.8 that previously broke Astro 6 + Vite 7 is now resolved under Astro 7 + Vite 8). pnpm-workspace.yaml (catalog): - vite: ^6.4.2 -> ^8.1.0 - @tailwindcss/vite: ^4.1.11 -> ^4.3.3 packages/website: - astro: ^6.4.6 -> ^7.0.6 (closes #290, #291, #292, #293, #301, #302) - @astrojs/react: ^5.0.5 -> ^6.0.1 - @astrojs/starlight: ^0.39.2 -> ^0.41.5 - @astrojs/vercel: ^10.0.7 -> ^11.0.3 - vite-plugin-inspect dep + import + astro.config wiring removed. All published versions (latest 12.0.2 included, broader peers '^6/^7/^8' covered by 11.4.1) crash the new vite@8 environment model in InspectContextVite.getEnvContext ([postcss] Can not found environment context for client). The plugin was a dev-only debug overlay running in dev + prod build; the live site is unaffected. packages/spotlight: - @vitejs/plugin-react: ^4.3.2 -> ^6.0.0 (peer vite ^8) - vite-plugin-svgr: ^3.3.0 -> ^5.2.0 (peer vite >= 3; v5 requires configuring exportType: 'named' + namedExport: 'ReactComponent' for the spotlight UI's import { ReactComponent as X } pattern to keep compiling without touching 27 UI source files) - version: 4.11.8 -> 4.11.9 (skip ahead of released 4.11.8 so craft publishes a fresh patch tag, no collision with the existing 4.11.8 release). packages/spotlight/src/svg.d.ts (new): - ambient declaration so TypeScript still accepts the named ReactComponent import shape the spotlight UI uses everywhere. packages/spotlight/vite.config.base.ts: - configure vite-plugin-svgr with include: ['**/*.svg', '**/*.svg?react'], svgrOptions: { titleProp: true, exportType: 'named', namedExport: 'ReactComponent' } so the existing import shape works without touching UI code. Root package.json overrides: - vite: replaced the two 'vite@>=6' and 'vite@>=7' rules with 'vite': '>=8.1.0 <9' - brace-expansion: added a 5.x line force 'brace-expansion@>=5.0.0': '>=5.0.8' alongside the per-major 1.x/2.x/3.x/4.x lines already on main; closes #323 without breaking the astro config path. - @hono/node-server: '>=2.0.5 <3' belt override on top of the direct-dep bump; forces the SDK's transitive ^1.19.14 up. - sharp: '>=0.35.0 <0.36' belt override (closes #312; bounds the ceiling so a 0.36+ breaking change can't silently float in). - svgo: '>=4.0.2 <5' added. - builder-util-runtime: '>=9.7.0 <10' added (closes #318; bounds). - app-builder-lib: '>=26.15.0 <27' added (closes #317; bounds). - floor raises (alerts #295-#300, #303, #311, #313, #320, #321): tar >=7.5.21, js-yaml >=4.3.0, body-parser >=2.3.0, fast-uri >=3.1.4, postcss >=8.5.18, shell-quote >=1.9.0. Verification (Linux dev box, the only env available locally): - pnpm install: no NEW peer warnings vs main. Pre-existing: - @napi-rs/wasm-runtime wants @emnapi/core@^2 (rolldown binding) - app-builder-lib wants electron-builder-squirrel-windows@26.x (pre-existing from PR #1335 electron-builder 26 migration). - pnpm --filter @spotlightjs/website build: 29 pages in 8.92s, Pagefind + @astrojs/sitemap + @astrojs/vercel adapter succeed. - pnpm --filter @spotlightjs/spotlight build: vite renderer + main bundles on vite@8.1.5 + rolldown, both succeed. - pnpm --filter @spotlightjs/spotlight test: 215 / 215 pass. - pnpm lint: pre-existing 2 errors in files not touched here (src/shared/version.ts formatter, server/main.ts import-sort); an editor-only fixup in packages/spotlight/package.json makes my branch no worse than main. - Empirical mac-path crash reproductions, in /tmp/opencode/syn.cjs: 1) new minimatch.Minimatch('foo/{a,b}/x.png').braceExpand() with minimatch@10.2.5 + brace-expansion@5.0.8 -> OK (was failing before per-major overrides) 2) plist.parse('<plist/>') via @xmldom/xmldom@0.8.13 -> OK (was crashing DOMParser mimeType before <0.9 ceiling) 3) DOMParser.parseFromString('<plist/>') without mimeType arg -> OK (regression test for #1337's @xmldom fix) Reviewer notes: - macOS build path (build:mac) is not exercisable from a Linux box; CI mac job is the source of truth. The per-major brace-expansion and @xmldom/xmldom <0.9 ceiling directly mirror main's pinned ranges, so macOS behavior should match main. - vite-plugin-inspect removal drops the dev-only __inspect__ UI route from the website. Tracked independently for upstream vite-8 compat. - Spotlight 4.11.9 will be a patch release superseding 4.11.8 with these transitive security deps; 4.11.8 stays published.
Member
Author
|
Closing in favor of #1342, which has been updated to incorporate the dependabot overrides plus the Astro 7 / Vite 8 migration as a single, focused change. The advisory review (and the inline Seer comments) found three things that weren't right in this PR's original shape — all corrected in the latest #1342 push:
Closed-PR aliases: #1341 → #1342 for closing the 27 alerts (#290–#304, #311–#323). #322 (react-router RSC CSRF) remains open: patched only in |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediate 22 of the 24 open Dependabot security alerts via pnpm overrides and two direct dependency bumps. The remaining two (
#301,#302forastro < 7.0.6) require a coordinated Astro 6→7 / Vite 8 migration and will be addressed in a follow-up PR.#322(react-router RSC CSRF) is patched only inreact-router-dom@8.3.0which is not yet published.Changes
Direct dependency bumps (
packages/spotlight/package.json)@hono/node-server:^1.19.14→^2.0.5(closes Show error page with hint CMD+R if an error happens #304)react-router-dom:^7.17.0→^7.18.0(closes feat(performance tab): To capture DB queries on spotlightjs #314, docs(nextjs): added nextjs support docs #315, docs(nextjs): Remove SvelteKit reference in next.js doc #316, Docs: fixed nextjs docs #319)pnpm overrides raised to patched floors (
package.json)tar>=7.5.21brace-expansion(2.x line)>=2.1.3js-yaml>=4.3.0 <5shell-quote>=1.9.0postcss>=8.5.18fast-uri>=3.1.4sharp>=0.35.0svgo>=4.0.2body-parser>=2.3.0builder-util-runtime>=9.7.0app-builder-lib>=26.15.0@hono/node-server>=2.0.55.x brace-expansion line workaround (#323)
The 5.x brace-expansion line (pulled via
@vercel/nft→glob@13→minimatch@10) is eliminated by overridingglob@>=13.0.0→10.4.5. Forcingbrace-expansionto5.0.8(the only patched 5.x) breaks Vite's config loader because 5.0.8 ships__esModule: truewithout adefaultexport, which breaks CJS default imports. Theglob@10downgrade keeps brace-expansion firmly on the 2.x line (which we already patched to 2.1.3).Verification
pnpm installclean (peer warnings unchanged from main, no new ones).pnpm --filter website build: 29 pages built.pnpm --filter @spotlightjs/spotlight build: renderer + main built successfully (electron-builder path).pnpm --filter @spotlightjs/spotlight test).biome: 2 pre-existing lint errors unchanged.Out of scope
#301,#302— astro < 7.0.6: requires Astro 6→7 + Vite 8 (Astro 7 hard-pinsvite@^8.0.13). Tracked as a separate migration PR with vite-plugin upgrades inpackages/spotlight.#322— react-router RSC CSRF: patched only inreact-router-dom@8.3.0, which has not been published yet. Will revisit when the-dompackage ships 8.3.0.Notes
packages/website/content.config.tsis intentionally not staged (legacy untracked file from an earlier migration; tracked canonical file atpackages/website/src/content.config.ts)..opencode/excluded per convention.