chore(deps): higiene dependencias B1+B2+B5 — card b1569dc1 - #9
Merged
Conversation
added 3 commits
August 26, 2026 20:27
The repo is pnpm-only (Dockerfile and CI install with pnpm install --frozen-lockfile). The npm lockfile was stale since 2026-06-30 and nothing consumed it, yet Dependabot scanned it as a second manifest, accounting for 52 of the 123 alert instances. Also ignore the root package-lock.json so a stray npm install cannot re-add it. Part of dependency hygiene card b1569dc1.
Semver-compatible lockfile refresh (package.json ranges untouched): - next 16.2.6 -> 16.2.11 (fixes 8 high + 10 moderate advisories) - dompurify 3.4.5 -> 3.4.13 (direct dep; monaco-editor pins 3.2.7 exactly and stays for a targeted follow-up) - postcss 8.5.15 -> 8.5.26 (direct; next pins its own 8.4.31 copy) - lodash 4.17.21 -> 4.18.1 (direct; @appium/logger pins 4.17.21) - nanoid 3.3.12 -> 3.3.18 - js-yaml 4.1.1 -> 4.3.1 - ip-address 10.2.0 -> 10.5.0 - brace-expansion 1.1.14/2.1.0/5.0.6 -> 1.1.18/2.1.4/5.0.9 - @babel/core 7.29.0 -> 7.29.7 - sharp stays 0.34.5: next 16.2.11 pins ^0.34.5, so the 0.35.0 fix requires the next 16.3 targeted upgrade (follow-up card) Verified: pnpm install --frozen-lockfile (pnpm 9, same as CI) passes. Part of dependency hygiene card b1569dc1.
Root cause of the 123-alert accumulation: Dependabot alerts are enabled by default but no .github/dependabot.yml existed, so no update PRs were ever opened. This adds grouped weekly version updates for the npm ecosystem (pnpm-lock.yaml), one PR per week for all packages, with conventional commit prefixes matching the repo style. Dependabot security updates (separate repo setting) still need to be enabled in repo settings — noted in the PR description. Part of dependency hygiene card b1569dc1.
SabaTech-dev
added a commit
that referenced
this pull request
Aug 26, 2026
…fresh undici/ws + vite 8.0.16 + monaco 0.56 — card b97898c5 (#10) - pnpm.overrides: shell-quote 1.9.0 (CVE-2026-9277 GHSA-w7jw-789q-3m8p >=1.8.4 + GHSA-395f-4hp3-45gv >=1.9.0; via teen_process ^1.8.1, dev-scope) - pnpm.overrides: vite 8.0.16 (peer autoinstalado pegado a 8.0.14, advisory <=8.0.15) - pnpm.overrides: @appium/logger>lodash 4.18.1 (pin exacto 4.17.21, code injection) - pnpm.overrides: monaco-editor>dompurify 3.4.13 (monaco 0.56.0 pinea 3.4.8 exacto, 3 advisories >=3.4.9/3.4.11/3.4.12) - pnpm.overrides: next>sharp 0.35.4 (4 CVEs libvips <0.35.0, runtime) - lockfile refresh in-range: undici 7.25.0->7.29.0 / 6.25.0->6.28.0 (cheerio ya latest), ws 8.20.1->8.21.3 / 7.5.10->7.5.13 (lighthouse), vitest 4.1.7->4.1.11 - monaco-editor 0.55.1->0.56.0 (peer-compatible >=0.25.0 <1, suelta pin dompurify 3.2.7) - excluidos con evidencia: next 16.3.x (0 advisories abiertas en 16.2.11, minor-stability aprobada PR #9), postcss 8.4.31 (pin exacto de next, se cura con 16.3), extract-zip (B4 security sin fix), @opentelemetry/core 1.30.1 y deepmerge-ts 7.1.5 (fix solo major) - hallazgo: bloque root 'overrides' de package.json es config muerta (pnpm 9 no la aplica; las 3 entradas son resolucion natural), se deja intacta para decision aparte Verificacion: frozen-lockfile OK, build verde (14s), test:run 1064/1064 (96 files), tsc 172 = baseline main, pnpm audit 13->7 (residuales fuera de alcance B3 documentados) Co-authored-by: Joker <joker@sabatech.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single dependency-hygiene PR implementing batches B1+B2+B5 from the security triage of the 123 Dependabot alerts (report:
amc-dependabot-triage-2026-08-26.md, cardb1569dc1). B3 (targeted upgrades) and B4 (documented acceptance ofextract-zip) go in separate cards.B1 — Structural hygiene: remove vestigial
package-lock.jsongit rm package-lock.json(stale since 2026-06-30; nothing consumes it — Dockerfile and all CI jobs install withpnpm install --frozen-lockfile)package-lock.jsonadded to.gitignoreso a straynpm installcannot re-add itB2 — In-range lockfile refresh (package.json ranges untouched)
B5 — Anti-recurrence policy:
.github/dependabot.ymlversioning-strategy: auto, conventional commit prefixesExpected impact on Dependabot alerts (after merge + re-scan)
123 → ~11–25 open alerts. Residuals are B3/B4 territory:
sharp0.34.5 stays (next 16.2.11 pins^0.34.5; the 0.35.0 fix needs the next 16.3 targeted upgrade — follow-up card)dompurify3.2.7 (monaco-editor pins it exactly) andlodash4.17.21 (@appium/logger pins it exactly) — need holder bumps/overridespostcss8.4.31 pinned by next itselfextract-zip(2 high, no upstream fix) → documented acceptance by securityVerification (pnpm 9.15.9, same major as CI pin
version: 9)pnpm install --frozen-lockfile— passes (CI gate)pnpm build— greenpnpm test:run— 96 files / 1064 tests passedpackage.jsonunchanged (git diffclean)tsc --noEmit— 172 errors, identical count to origin/main baseline (pre-existing; build config hasignoreBuildErrors: true)dependabot.ymlvalid YAML (parsed + schema-checked)Known issues (pre-existing, not introduced here)
pnpm lintfails on main and here: noeslint.config.*exists in the repo (ESLint 9 needs flat config). CI already tolerates it (pnpm lint || true). Worth a dedicated card.Follow-ups
extract-zip(no fix available)