build(deps): resolve open Dependabot security alerts (npm + Go) - #593
Merged
Conversation
Bump catalog entries dompurify ^3.4.12, hono ^4.12.31, sharp ^0.35.3 (supersedes dependabot PR #587), add vulnerable-range-scoped pnpm overrides for transitive fixes (tar, js-yaml, brace-expansion, immutable, linkify-it, fast-uri, svgo, @hono/node-server 2.x, sharp), and bump google.golang.org/grpc to v1.82.1.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🦋 Changeset detectedLatest commit: 89913da The changes in this PR will be included in the next version bump. This PR includes changesets to release 19 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
fforootd
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Updates dependency constraints to address the majority of open Dependabot security alerts across the TypeScript (pnpm) workspace and the Go module graph.
Changes:
- Bumps selected workspace catalog dependencies (
dompurify,hono,sharp) inpnpm-workspace.yaml. - Adds pnpm
overridesin the rootpackage.jsonto force patched transitive versions for multiple advisories. - Updates Go dependencies, including a
google.golang.org/grpcbump, with correspondinggo.sumupdates.
Reviewed changes
Copilot reviewed 3 out of 5 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Catalog bumps for vulnerable direct dependencies (dompurify/hono/sharp). |
| package.json | Adds security-focused pnpm overrides for vulnerable transitive dependency ranges. |
| go.mod | Bumps gRPC and related Go dependencies (and drops an unused direct requirement). |
| go.sum | Updates Go module checksums to match the updated module graph. |
…del/nextgen into claude/security-issues-fixes-082474
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the actionable Dependabot alerts without overriding dependency compatibility contracts.
@hono/node-server,immutable, andtar.sharp@0.35.3, while Next.js 16.2.4 and Fumapress retain their declared compatiblesharp@0.34.5dependency.Intentionally constrained
@hono/node-server@1.19.xpath remains until its parent dependency accepts the 2.x line.sharp@0.34.5for Next.js/Fumapress because Sharp 0.35 is a breaking release and those packages currently declare^0.34.x.Validation
corepack pnpm install --frozen-lockfilecorepack pnpm exec changeset status --since origin/mainmoon run workspace:check -- --only releaseRelease notes / changeset
.changeset/security-dependency-bumps.mdexplicitly records patch releases for both@zitadel/componentsand@zitadel/server.Notes