fix(deps): pin patched transitive frontend packages

[felipebergamin]

Summary

Pins the transitive frontend packages that have open Dependabot alerts. Each package is its own commit. GitHub will keep the alerts open until this lockfile reaches main and Dependabot rescans it.

Updated dependencies:

Alert	Package	From	To	Advisory
271	source-map-js	1.2.1	1.2.2	GHSA-68fv-2mgg-jv7q
178	@babel/core	7.28.3 and 7.29.0	7.29.7	GHSA-4x5r-pxfx-6jf8
88, 89	webpack	5.98.0	5.104.1	GHSA-8fgc-7cc6-rx7x, GHSA-38r7-794h-5758
162	uuid	9.0.1	11.1.1	GHSA-w5hq-g745-h8pq

dashboard/package.json holds the overrides. dashboard/pnpm-lock.yaml is the generated lockfile. There were no open pip alerts.

Notes for reviewers

@babel/core is pinned to 7.29.7. The advisory's first patched release is 7.29.6. @tanstack/router-plugin already requires ^7.29.7, and @vitejs/plugin-react (^7.28.0) and react-docgen (^7.18.9) both allow 7.29.7. source-map-js 1.2.2 is inside the ^1.2.x ranges of postcss, @tailwindcss/node, and magicast.

Webpack stays on major 5. The 5.104.1 release depends on es-module-lexer ^2, so that edge moves from 1.7.0 to 2.3.2. 2.3.2 was already in the lockfile for another package. Both webpack advisories need experiments.buildHttp. GitHub marks alerts 88 and 89 as runtime.

uuid moves from 9.0.1 to 11.1.1. @storybook/addon-actions 8.6.18 declares uuid ^9.0.0 and only calls v4. 11.1.1 still exports v4 for both require and import. @types/uuid stays at 9.0.8. Alert 162 is development scope.

pnpm audit still reports braces 3.0.3. GitHub has no open alert for it, so it is unchanged.

Local checks used pnpm 10.33.3, matching packageManager, on Node 26.8.2. .nvmrc is 20.15.0, and CI still installs pnpm 9.15.2. The lockfile version stayed 9.0. The decision log is in a comment on this pull request. gh pr comment --attach only accepts images and video, so the TSV is inlined there.

Test plan

• cd dashboard && pnpm install --frozen-lockfile
• pnpm why source-map-js resolves only 1.2.2
• pnpm why @babel/core resolves only 7.29.7
• pnpm why webpack resolves only 5.104.1
• pnpm why uuid resolves only 11.1.1
• pnpm test
• pnpm build
• From @storybook/addon-actions, require('uuid').v4() returns a string

[felipebergamin]

Decision log for this dependency pass, including the webpack and uuid pins. gh pr comment --attach only accepts images and video, so the TSV is inlined here.

ts	phase	decision	why	evidence	result
2026-10-09T20:52:23Z	frame	Created branch fix/dependabot-alerts from upstream/main at 7f841964	Dependency fixes should not include the skills commit on chore/dependabot-skills	git rev-parse HEAD	branch created, tracking unset
2026-10-09T20:52:23Z	frame	Fetched 5 open Dependabot alerts, all npm under dashboard/pnpm-lock.yaml	GitHub returned a complete paginated inventory and jq deduped it	/tmp/dependabot-work/alerts.json	5 npm alerts, 0 pip alerts
2026-10-09T20:52:23Z	frame	Skipped Poetry commands because no pip alerts are open	Poetry is not installed, and the Django skill has nothing to update	gh alerts ecosystem count	no pip alerts
2026-10-09T20:56:58Z	source-map-js	Pinned source-map-js to 1.2.2 with a pnpm override	1.2.1 is inside GHSA-68fv-2mgg-jv7q and every parent range already allows 1.2.2	commit 838bd1fa	lockfile has only 1.2.2, no new majors
2026-10-09T20:58:06Z	webpack	Reverted the webpack 5.104.1 override	webpack 5.104.1 requires es-module-lexer ^2, and the lock had 1.7.0. That is a major bump, so the alert stays open.	npm view webpack@5.104.1 dependencies.es-module-lexer	skipped, lockfile restored to 5.98.0
2026-10-09T21:00:48Z	babel	Pinned @babel/core to 7.29.7	7.28.3 and 7.29.0 are inside GHSA-4x5r-pxfx-6jf8. 7.29.7 is the version TanStack Router already requires.	commit 6550a436	only 7.29.7 remains, no new majors
2026-10-09T21:00:48Z	uuid	Left uuid at 9.0.1	Storybook addon-actions allows only ^9.0.0. The published fix is 11.1.1, and 9.x has no patched release.	npm view uuid versions; pnpm why uuid	skipped, alert 162 stays open
2026-10-09T21:00:48Z	verify	Typecheck, Vitest, and the Vite production build passed after both pins	Checked the real toolchain on the updated lockfile, on Node 26.8.2 rather than the .nvmrc Node 20.15.0	tsc exit 0, vitest 163 passed, vite build exit 0	tests green
2026-10-09T21:00:48Z	audit	pnpm audit still reports webpack, uuid, and braces	source-map-js and @babel/core dropped out of the audit. braces 3.0.3 is not an open GitHub alert.	/tmp/dependabot-work/pnpm-audit.json	webpack and uuid match the skips, braces is extra
2026-10-09T21:01:14Z	frame	Used the pnpm 10.33.3 binary from the store, not pnpm 12.8.1 on PATH	package.json pins packageManager pnpm@10.33.3. The PATH copy is 12 and would rewrite the lockfile.	dashboard/package.json packageManager	installs reported pnpm v10.33.3
2026-10-09T21:01:14Z	frame	Used pnpm overrides instead of bumping parent packages	The repo already pins transitive fixes in package.json pnpm.overrides, and the parent ranges already allow the patched versions.	dashboard/package.json overrides	source-map-js and @babel/core only
2026-10-09T21:03:25Z	webpack	Corrected the webpack skip: es-module-lexer 2.3.2 was already in the lock for another package	webpack 5.98.0 depends on es-module-lexer ^1.2.1. 5.104.1 depends on ^2. Moving webpack onto 2.3.2 is still a major change on that edge, so the override stays reverted.	dashboard/node_modules/.pnpm/webpack@5.98.0_esbuild@0.25.12_lightningcss@1.31.1/node_modules/webpack/package.json	alerts 88 and 89 stay open, runtime scope
2026-10-09T21:03:25Z	uuid	Confirmed Storybook addon-actions 8.6.18 depends on uuid ^9.0.0	The installed package.json is the constraint. uuid 11.1.1 is outside it and outside major 9.	dashboard/node_modules/.pnpm/@storybook+addon-actions@8.6.18_storybook@8.6.18_prettier@3.3.2_/node_modules/@storybook/addon-actions/package.json	alert 162 stays open, development scope
2026-10-09T21:03:25Z	verify	Re-ran typecheck and Vitest and saved the output	The first verification row had no saved log. dist/index.html is from the Vite build at 17:59 local.	.audit/verify.txt, dashboard/dist/index.html	tsc exit 0, vitest 163 passed
2026-10-09T21:03:25Z	audit	Left braces 3.0.3 alone	pnpm audit reports it, GitHub has no open alert for it, and this pass only changes packages that have an open Dependabot alert.	/tmp/dependabot-work/pnpm-audit.json	not changed
2026-10-09T21:06:34Z	publish	User approved pushing fix/dependabot-alerts and opening the pull request	The branch stays on the fork until this confirmation.	user message 2026-10-09	pushing to origin
2026-10-09T21:07:06Z	publish	Opened pull request 2171	The branch is on origin and the PR targets kernelci/dashboard main.	https://github.com/kernelci/dashboard/pull/2171	open
2026-10-09T21:07:07Z	publish	Attached the decision log on pull request 2171	Reviewers can audit the trail from the comment. This row is newer than the attached copy.	https://github.com/kernelci/dashboard/pull/2171	comment posted
2026-10-09T21:09:18Z	publish	Inlined the decision log on pull request 2171 after --attach rejected the tsv	gh pr comment --attach only accepts images and video. The earlier row that said the file was attached is wrong.	https://github.com/kernelci/dashboard/pull/2171	comment posted, file not uploaded as an attachment
2026-10-09T21:12:27Z	backend	Refetched open alerts after Poetry 2.4.1 was installed and found no pip alerts	The Django skill only changes backend dependencies that have an open alert. The new inventory is still five npm alerts.	/tmp/dependabot-work/alerts.json	no backend changes
2026-10-09T21:16:07Z	frame	User asked to ignore the major-bump limit and fix the remaining alerts on the same pull request	Alerts 88, 89, and 162 were left open because the fixes cross a major. That limit is lifted for this pass.	https://github.com/kernelci/dashboard/pull/2171	webpack and uuid in scope
2026-10-09T21:17:55Z	webpack	Pinned webpack to 5.104.1	User lifted the major-bump limit. 5.104.1 closes both webpack alerts. es-module-lexer on that edge moves from 1.7.0 to 2.3.2.	commit 577ddd55	only webpack 5.104.1 remains
2026-10-09T21:17:55Z	uuid	Pinned uuid to 11.1.1	Storybook addon-actions calls v4 only, and 11.1.1 still exports v4 for require and import. The parent range is still ^9.0.0.	commit 370be0fd	only uuid 11.1.1 remains
2026-10-09T21:17:55Z	verify	Typecheck, Vitest, and the Vite build passed after the webpack and uuid pins	Checked the toolchain before pushing to the existing pull request.	.audit/verify-webpack-uuid.txt	tsc exit 0, vitest 163 passed, vite build exit 0
2026-10-09T21:17:55Z	audit	pnpm audit no longer reports webpack or uuid	braces 3.0.3 is still reported and still has no open GitHub alert.	/tmp/dependabot-work/pnpm-audit-after.json	only braces remains
2026-10-09T21:18:11Z	publish	Pushed webpack and uuid commits onto pull request 2171	The user asked to update the same pull request.	https://github.com/kernelci/dashboard/pull/2171	origin/fix/dependabot-alerts at 370be0fd
2026-10-09T21:19:40Z	verify	ESLint on src passed, and Storybook addon-actions preview.mjs loaded	ESLint is the path that loads the webpack resolver. preview.mjs imports uuid v4.	eslint exit 0, preview.mjs import exit 0	both commands green