fix(security): Update dependencies to fix security vulnerabilities. - #6085
Conversation
✅ Deploy Preview for ohif-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthrough
ChangesWorkspace Dependency and Audit Config Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pnpm-workspace.yaml (1)
22-27:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winStale comment describing ignored GHSAs.
The comment on lines 22-25 describes the rationale for accepting minimatch/picomatch advisories as risk, but
ignoreGhsasis now empty since these vulnerabilities are being fixed via the new overrides on lines 87-90. Consider updating or removing the comment to reflect the new approach.-# Equivalent of the bun `audit --ignore=...` flags. These GHSAs are accepted -# risk: minimatch/picomatch advisories reached only via build/CI tooling, never -# fed user-supplied expressions. Kept in sync with the .circleci SECURITY_AUDIT -# job and the root `audit` script. +# Audit configuration. GHSAs are addressed via overrides rather than being +# suppressed here; keep the ignore list empty unless accepting a specific risk. auditConfig: ignoreGhsas: []🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm-workspace.yaml` around lines 22 - 27, The comment block preceding the auditConfig section references minimatch/picomatch advisories being accepted as risk and kept in sync with security configurations, but the ignoreGhsas array is now empty and these vulnerabilities are being handled via overrides on lines 87-90 instead. Update the comment to accurately describe the current approach using overrides for vulnerability management, or remove the comment entirely if it is no longer applicable to the auditConfig configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 83-90: The pnpm-workspace.yaml overrides section is missing an
entry for the Vite package to address GHSA-fx2h-pf6j-xcff vulnerability. Add a
vite override entry in the overrides section (located after the existing entries
like picomatch and other packages) with an appropriate version that resolves the
GHSA-fx2h-pf6j-xcff vulnerability. The override should follow the same pattern
as the other entries in the file, specifying the package name and the fixed
version number.
---
Outside diff comments:
In `@pnpm-workspace.yaml`:
- Around line 22-27: The comment block preceding the auditConfig section
references minimatch/picomatch advisories being accepted as risk and kept in
sync with security configurations, but the ignoreGhsas array is now empty and
these vulnerabilities are being handled via overrides on lines 87-90 instead.
Update the comment to accurately describe the current approach using overrides
for vulnerability management, or remove the comment entirely if it is no longer
applicable to the auditConfig configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0fb01be8-bc8c-46ec-94a2-e963f5447762
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
pnpm-workspace.yaml
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # tslib@2 that modern packages (e.g. react-remove-scroll) need for | ||
| # __spreadArray. | ||
| tslib: ^2.8.1 | ||
| tslib: 2.8.1 |
There was a problem hiding this comment.
tslib override changed from the range ^2.8.1 (any 2.x.x ≥ 2.8.1) to the exact pin 2.8.1. The intent — a single shared tslib across the workspace — is preserved either way, but an exact pin means a future pnpm audit finding against tslib 2.8.1 would require a manual edit here before it can be resolved. Consider keeping the caret form so a pnpm update tslib can pick up patch releases without touching this file.
| tslib: 2.8.1 | |
| tslib: ^2.8.1 |
Prompt To Fix With AI
This is a comment left during a code review.
Path: pnpm-workspace.yaml
Line: 83
Comment:
The `tslib` override changed from the range `^2.8.1` (any 2.x.x ≥ 2.8.1) to the exact pin `2.8.1`. The intent — a single shared tslib across the workspace — is preserved either way, but an exact pin means a future `pnpm audit` finding against tslib 2.8.1 would require a manual edit here before it can be resolved. Consider keeping the caret form so a `pnpm update tslib` can pick up patch releases without touching this file.
```suggestion
tslib: ^2.8.1
```
How can I resolve this? If you propose a fix, please make it concise.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
There was a problem hiding this comment.
The team prefers to use exact versioning to better protect against supply chain attacks.
2 participants
Context
See...
GHSA-7c78-jf6q-g5cm
GHSA-96hv-2xvq-fx4p
GHSA-hmw2-7cc7-3qxx
GHSA-wcpc-wj8m-hjx6
Changes & Results
Updated various dependencies via resolutions.
Testing
All automated tests and checks should pass.
Checklist
PR
semantic-release format and guidelines.
Code
etc.)
Public Documentation Updates
additions or removals.
Summary by CodeRabbit
Greptile Summary
This PR updates
pnpm-workspace.yaml(and regenerates the lock file) to address five security advisories by upgradingprotobufjs(7.5.7→7.6.1) andtmp(0.2.6→0.2.7), and adding targetedoverridesentries that force vulnerable transitive copies ofws,form-data,minimatch, andpicomatchto patched versions.ignoreGhsas(three minimatch ReDoS + one picomatch prototype-injection) are now properly remediated through the new override ranges and removed from the ignore list.ws@7.5.11/8.21.0,form-data@4.0.6,minimatch@3.1.5/5.1.9/9.0.9/10.2.5,picomatch@2.3.2/4.0.4— all at or above the advisory-patched thresholds.tsliboverride was tightened from the range^2.8.1to the exact pin2.8.1; this achieves the stated goal of a single shared tslib but reduces flexibility for future patch-level security updates to tslib itself.Confidence Score: 4/5
Safe to merge — all dependency pins are at or above the advisory-patched thresholds and the lock file matches.
The dependency upgrades and override ranges are correct and fully reflected in the lock file. The only non-trivial change worth a second look is the
tslibexact pin, which is intentional but slightly reduces the project's ability to absorb future tslib patch releases without a manual edit.pnpm-workspace.yaml — specifically the
tslib: 2.8.1exact pin and the completeness ofignoreGhsas: []if any previously-ignored advisories are not fully covered by the new overrides.Important Files Changed
^2.8.1to exact pin2.8.1.Prompt To Fix All With AI
Reviews (1): Last reviewed commit: "fix(security): Update dependencies to fi..." | Re-trigger Greptile