chore(deps): clear all 16 advisories — bump undici, drop the unused puppeteer chain - #235
Merged
Conversation
…uppeteer chain
`scan / osv-scan` is a REQUIRED check on main and has been failing since at
least 2026-08-10, so every PR sits BLOCKED regardless of its contents. This
unblocks the queue.
Two independent chains, both dev-only, neither shipped to users (the prod
artifact is static HTML/CSS/JS on GitHub Pages — no Node runtime):
1. undici 7.26.0 → 7.29.0, via jsdom (vitest's DOM environment). Clears 8
advisories: Set-Cookie SameSite downgrade, shared-cache whitespace bypass,
retry-interceptor desync, degenerate private-cache directives, CRLF via
blob body type, Cache-Control whitespace, cookie attribute injection, and
keep-alive queue poisoning. Plain `npm audit fix`, no major bump.
2. `@size-limit/preset-app` → `@size-limit/file`. The preset pulls
`@size-limit/time` → estimo → puppeteer-core / extract-zip / find-chrome-bin
/ nanoid — 8 more advisories, and estimo is stale upstream so neither
`npm audit fix` nor bumping the preset to 13.x clears them.
We were carrying a headless browser to measure nothing: the size-limit
config set `"running": false` on BOTH entries, which explicitly disables the
execution-time measurement that plugin exists for. Only file size was ever
checked. Swapping to `@size-limit/file` removes the whole chain rather than
suppressing it.
The `"running": false` keys are removed with it — size-limit rejects that
option when the time plugin is absent ("Config option running needs
@size-limit/time plugin"), even set to false.
`npm audit`: 16 vulnerabilities (2 moderate, 14 high) → **0**.
Deliberately NOT added to osv-scanner.toml. That file's existing vite/esbuild
entries are legitimate — those are genuinely unfixable without a major bump —
but suppressing something removable is how a scanner quietly stops meaning
anything.
Verified: `npm exec size-limit` (the exact CI invocation) still measures both
budgets — index js 167.64 kB / 350 kB, css 6.29 kB / 60 kB, unchanged from
before. `npm run gate` green: 87 test files, 1285 passed, 3 skipped.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
size-limit report 📦
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this is urgent rather than housekeeping
scan / osv-scanis a required check onmainand has been failing since at least2026-08-10. Every PR is
BLOCKEDon it regardless of contents — including #234 (retire themaintenance banner), which is otherwise 8/9 green. This unblocks the queue.
npm audit: 16 vulnerabilities (2 moderate, 14 high) → 0.Two independent chains, both dev-only
Neither reaches users — the prod artifact is static HTML/CSS/JS on GitHub Pages, no Node runtime.
1.
undici7.26.0 → 7.29.0 — viajsdom, vitest's DOM environment. Clears 8 advisories:Set-Cookie SameSite downgrade, shared-cache whitespace bypass, retry-interceptor desync,
degenerate private-cache directives, CRLF via blob body
type, Cache-Control whitespace, cookieattribute injection, keep-alive queue poisoning. Plain
npm audit fix, no major bump.2.
@size-limit/preset-app→@size-limit/file— clears the other 8.The preset pulls
@size-limit/time→estimo→puppeteer-core/extract-zip/find-chrome-bin/nanoid.estimois stale upstream, so neithernpm audit fixnor bumpingthe preset to 13.x clears it — I tried both.
The interesting part: we were carrying a headless browser to measure nothing. The size-limit
config sets
"running": falseon both entries, which explicitly disables the execution-timemeasurement
@size-limit/timeexists to provide. Only file size was ever checked. So the fix isremoval, not suppression.
The
"running": falsekeys go with it — size-limit rejects the option when the plugin is absent(
Config option running needs @size-limit/time plugin) even when set tofalse.Deliberately not suppressed
I did not add these to
osv-scanner.toml. Its existing vite/esbuild entries are legitimate —genuinely unfixable without a major bump, documented, with a lift plan. But suppressing something
removable is how a scanner quietly stops meaning anything, and this one was already the only
thing standing between the repo and a mergeable queue.
Verified
npm auditnpm exec size-limit(exact CI invocation)npm run gateThe size budgets are measured identically before and after; only the plugin providing the
measurement changed.
🤖 Generated with Claude Code