chore(deps): remediate 16 root-lockfile advisories by Ndevu12 · Pull Request #106 · Ndevu12/RichTextEditor

Ndevu12 · 2026-07-31T18:38:01Z

Closes 16 of the 18 open Dependabot alerts on the root yarn.lock. The remaining tar alerts are handled in #104.

Direct devDependencies — manifest floor raised alongside the lockfile

Package	Change	Alerts
`vite`	`^8.0.0` → `^8.0.16` (resolves 8.2.0)	#54 high, #55 medium
`concurrently`	`^10.0.0` → `^10.0.4`	#86 high (via `shell-quote`)

concurrently@10.0.4 pins shell-quote@1.9.0 exactly, so bumping the real parent fixes shell-quote properly instead of forcing it with a resolutions override. shell-quote@1.8.4 is gone from the tree entirely — no override, no debt.

Transitive — lockfile only, all within existing declared ranges

Package	Change	Alerts
`@babel/core`	7.29.0 → 7.29.7	#68
`brace-expansion`	1.1.12 → 1.1.18	#103
`brace-expansion`	5.0.4 → 5.0.9	#81
`js-yaml`	4.1.1 → 4.3.1	#80, #101
`postcss`	8.5.15 → 8.5.25	#119
`undici`	7.24.4 → 7.29.0	#71, #72, #73, #74, #76, #77
`ws`	8.19.0 → 8.21.1	#67

Two things worth calling out

A stale duplicate nearly slipped through. Raising vite to ^8.0.16 left a second vite@8.0.8 behind an unrelated ^6 || ^7 || ^8 range, which kept a vulnerable postcss@8.5.15 alive in the tree. yarn up -R plus yarn dedupe collapses both to a single copy. Worth knowing that a naive yarn up vite would have silently left the alert open.

The vite bump introduced a new warning, so it is fixed here too. vite 8.2.0 warns that __dirname is unsupported under the native config loader that becomes the default in a future major. Both root vite configs now use import.meta.dirname (available since Node 20.11; CI runs Node 20.x). The bump leaves no new warning behind.

Verification

yarn build · 286 unit tests · yarn typecheck · yarn lint · yarn format:check · yarn verify:demos — all pass.

Not fixed here — both blocked upstream, neither reachable

Alert	Why not	Reachability
#50 `esbuild` (low)	`tsup@8.5.1` is the latest release and pins `esbuild@^0.27.0`, so 0.28.1 is unreachable without overriding a transitive pin	Windows-only path traversal in the esbuild dev server (`servedir`). tsup uses the bundler API and never starts that server.
#46 `uuid` (medium)	`@storybook/addon-actions@8.6.18` pins `uuid@^9.0.0`. Storybook 9+ drops the `uuid` dependency entirely, so the real fix is the v8 → v10 migration, not a pin	Advisory affects `v3()`/`v5()`/`v6()` with a caller-supplied buffer. addon-actions only calls `v4()`, with no buffer.

I deliberately did not add resolutions entries to force these. Overriding a pin that upstream has not validated is exactly the kind of debt this PR was asked to avoid, and neither vulnerability is reachable.

Separate pre-existing breakage found (not from this PR)

yarn build-storybook fails on main today:

Error: Cannot find module ..._@storybook/builder-vite/dist/index.js

I verified this against a clean main worktree — it reproduces identically, and this branch changes no @storybook/* version. Cause is a version split already in package.json: storybook/@storybook/core at ^8.6.0 (8.6.18) against @storybook/react-vite/builder-vite at ^10.3.4. This also produces the existing peer-dependency warnings, and it is what blocks the uuid fix above.

This gates the Build storybook step in deploy.yml. The Storybook v8 → v10 migration would fix the broken deploy job and close #46 in one go — worth its own PR.

Closes 16 of the 18 open Dependabot alerts on the root yarn.lock. (The remaining tar alerts are handled separately in #104.) Direct devDependencies — manifest floor raised alongside the lockfile: vite ^8.0.0 -> ^8.0.16 (resolves 8.2.0) #54 high, #55 medium concurrently ^10.0.0 -> ^10.0.4 #86 high (via shell-quote) concurrently 10.0.4 pins shell-quote 1.9.0 exactly, so bumping the real parent fixes shell-quote properly rather than forcing it with a resolutions override. shell-quote 1.8.4 is gone from the tree entirely. Transitive — lockfile only, all within existing declared ranges: @babel/core 7.29.0 -> 7.29.7 #68 brace-expansion 1.1.12 -> 1.1.18 #103 brace-expansion 5.0.4 -> 5.0.9 #81 js-yaml 4.1.1 -> 4.3.1 #80, #101 postcss 8.5.15 -> 8.5.25 #119 undici 7.24.4 -> 7.29.0 #71, #72, #73, #74, #76, #77 ws 8.19.0 -> 8.21.1 #67 Raising vite to ^8.0.16 initially left a second vite 8.0.8 behind an unrelated `^6 || ^7 || ^8` range, which kept a vulnerable postcss 8.5.15 alive. `yarn up -R` plus `yarn dedupe` collapses both to a single copy, so no stale vulnerable duplicate remains. vite 8.2.0 warns that `__dirname` is unsupported under the native config loader that becomes the default in a future major. Migrated both root vite configs to `import.meta.dirname` so the bump leaves no new warning behind. Available since Node 20.11; CI runs Node 20.x. Verified: build, 286 unit tests, typecheck, lint, format:check, verify:demos. Not fixed here — both blocked upstream, neither reachable in this project: #50 esbuild (low) tsup 8.5.1 is the latest release and pins esbuild ^0.27.0, so 0.28.1 is unreachable without overriding a transitive pin. The advisory is a Windows-only path traversal in the esbuild dev server (servedir); tsup uses the bundler API and never starts that server. #46 uuid (medium) @storybook/addon-actions 8.6.18 pins uuid ^9.0.0. Storybook 9+ drops the uuid dependency entirely, so the real fix is the v8 -> v10 migration, not a pin. The advisory affects v3()/v5()/v6() with a caller supplied buffer; addon-actions only calls v4() with no buffer.

Closes **4 Dependabot alerts** on `playground/yarn.lock` — the last remaining alerts that a version bump can actually fix. | Advisory | CVE | Severity | Alert | |---|---|---|---| | GHSA-fx2h-pf6j-xcff | CVE-2026-53571 | high | #64 | | GHSA-p9ff-h696-f583 | CVE-2026-39363 | high | #19 | | GHSA-v6wh-96g9-6wx3 | CVE-2026-53632 | medium | #65 | | GHSA-4w7w-66w2-5vf9 | CVE-2026-39365 | medium | #21 | ## What changed ```diff - "vite": "^6.3.0", + "vite": "^6.4.3", ``` `vite` is a direct devDependency of the playground, so the declared floor is raised alongside the lockfile rather than pinning only the resolved version — consistent with how `next`, `concurrently`, and the root `vite` were handled in #105 and #106. A `yarn dedupe` follows the bump so no stale duplicate `vite`/`postcss` copy is left behind — the same trap that would have silently kept #119 open in #106. ## Verification - `yarn build` (library) — success - `yarn build` (playground) — success

…oy (#109) Fixes the **broken GitHub Pages deploy** and closes Dependabot alert **#46** (`uuid`). ## The deploy has been failing on every push `Deploy to GitHub Pages` has failed 6 runs in a row, going back to before any of this weeks security work. The `Build storybook` step dies, and because it fails, every later step — **including the deploy itself** — is skipped: ``` Build nextjs-demo success Build storybook failure Assemble deployment dir skipped Upload Pages artifact skipped Deploy to GitHub Pages skipped ``` So Pages has not published in days. (This is also what looked like "tests being cancelled" — nothing is cancelled; steps after the failure are *skipped*, which renders greyed-out.) ## Root cause `package.json` declared `@storybook/react-vite` at `^10.3.4` while `storybook` / `@storybook/core` stayed at `^8.6.0`. Storybook 8 core cannot load a v10 builder, so preset resolution died: ``` Error: Cannot find module ..._@storybook/builder-vite/dist/index.js ``` I confirmed this reproduces on a clean `main` worktree, so it is genuinely pre-existing and not a side effect of the dependency work. ## Changes | Package | Change | |---|---| | `storybook` | `^8.6.0` → `^10.5.5` | | `@storybook/addon-a11y` | `^8.6.0` → `^10.5.5` | | `@storybook/react-vite` | `^10.3.4` → `^10.5.5` | | `@storybook/addon-essentials` | **removed** — folded into core in v9+ | | `@storybook/blocks` | **removed** — folded into core in v9+, and was declared but never imported anywhere | Config and stories now import from the framework package (`@storybook/react-vite`) instead of the renderer (`@storybook/react`) — the latter was never a declared dependency and only resolved transitively, which is its own latent breakage. ## Closes #46 (`uuid`, medium) properly `@storybook/addon-actions@8.6.18` was the only thing pulling `uuid@^9.0.0`, and it was pinned to a major we could not reach. Storybook 9+ **dropped the `uuid` dependency entirely**, so after this migration `uuid` is absent from the lockfile: ``` grep -c "uuid@npm:" yarn.lock -> 0 ``` That is a real removal, not a `resolutions` override — which is exactly why I left it unfixed in #106 rather than forcing a pin. ## Verification - `yarn build-storybook` — **Storybook build completed successfully** (this is the previously failing step) - `yarn build` · **286 unit tests** · `yarn typecheck` · `yarn lint` · `yarn format:check` — all pass

Ndevu12 self-assigned this Jul 31, 2026

Ndevu12 force-pushed the security/root-lockfile-remediation branch from 9cd2121 to 53b853a Compare July 31, 2026 19:55

Ndevu12 merged commit 1fdc562 into main Jul 31, 2026
9 checks passed

Ndevu12 deleted the security/root-lockfile-remediation branch July 31, 2026 19:58

This was referenced Jul 31, 2026

chore(deps): bump vite from 6.4.1 to 6.4.3 in playground #108

Merged

fix(storybook): migrate Storybook v8 -> v10, repairing the Pages deploy #109

Merged

Navigation Menu

chore(deps): remediate 16 root-lockfile advisories - #106

chore(deps): remediate 16 root-lockfile advisories#106
Ndevu12 merged 1 commit into
mainfrom
security/root-lockfile-remediation

Ndevu12 commented Jul 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Ndevu12 commented Jul 31, 2026

Direct devDependencies — manifest floor raised alongside the lockfile

Transitive — lockfile only, all within existing declared ranges

Two things worth calling out

Verification

Not fixed here — both blocked upstream, neither reachable

Separate pre-existing breakage found (not from this PR)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant