fix(deps): patch dev toolchain vulnerabilities - #244
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe pull request updates four development dependency versions in ChangesDevelopment dependency updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
EtienneLescot
left a comment
EtienneLescot
left a comment
There was a problem hiding this comment.
Cleanly scoped and correct in substance: four devDependency bumps, nothing in dependencies moves, and the lockfile ends up with a single deduped esbuild because vite 7.3.6 widened its range to ^0.27.0 || ^0.28.0 — so 0.28.1 doesn't drag in a second copy. 21 → 15 findings with the remainder explicitly deferred to #243 is the honest framing, and the regeneration also quietly fixes a real bug on main (see the inline note on deepagents).
One blocking one-liner, one ordering issue.
Blocking: nix/package.nix still records sha256-SggSPoDnKzmvgXpIGP11y6h390SkoZszeMjFTaokRjQ=, byte-identical to main, while this PR re-resolves the dependency set (39 new resolved entries, 48 removed). .github/workflows/nix-check.yml triggers on pull_request with paths: [package-lock.json], recomputes the hash and exits 1 on mismatch. Run nix run nixpkgs#prefetch-npm-deps -- package-lock.json and paste the result into npmDepsHash.
Ordering: this conflicts with #243 in both package.json and package-lock.json (confirmed with git merge-tree). I want to land this one first since it's the larger regeneration, then have #243 rebase on top and re-run the prefetch there.
Note that no CI has run on this branch yet — the first-time-contributor gate — so the esbuild 0.27 → 0.28 major hasn't been exercised on a real build. I'll approve the run once the hash lands.
|
I approved CI on this branch and the Nix job failed on the Set |
nix-check.yml exists precisely to catch this: it triggers on any PR touching package-lock.json, recomputes the hash with prefetch-npm-deps and fails when the recorded one disagrees. This lockfile re-resolves 39 packages, so the hash main recorded no longer describes the dependency set, and `nix build` would fail outright for anyone installing through that channel. Value taken from the Nix job's own output on this branch rather than recomputed blind, and the lockfile has not moved since — main touched only package.json and nix/package.nix in the meantime.
296d292 to
bad0ce9
Compare
EtienneLescot
left a comment
EtienneLescot
left a comment
There was a problem hiding this comment.
Threads cleared, npmDepsHash refreshed, branch flattened so it can actually rebase-merge. Approving.
Four devDependency bumps, nothing in dependencies moves, and the lockfile ends up with a single deduped esbuild because vite 7.3.6 widened its range to ^0.27.0 || ^0.28.0. 21 advisories down to 15, with the remainder explicitly deferred to #243 rather than papered over.
The value getopenscreen#244 left behind describes the dependency set before electron-builder moved to 26.15.3, and that upgrade re-resolves a lot: 7zip-bin, app-builder-bin, dmg-license and iconv-corefoundation drop out while pkijs, asn1js, unzipper and @noble/hashes come in, because upstream moved code signing off vendored native binaries onto JS. So the recorded hash no longer matches and `nix build` fails outright for anyone installing through that channel. Taken from the Nix job's own output on this branch rather than computed blind.
The value #244 left behind describes the dependency set before electron-builder moved to 26.15.3, and that upgrade re-resolves a lot: 7zip-bin, app-builder-bin, dmg-license and iconv-corefoundation drop out while pkijs, asn1js, unzipper and @noble/hashes come in, because upstream moved code signing off vendored native binaries onto JS. So the recorded hash no longer matches and `nix build` fails outright for anyone installing through that channel. Taken from the Nix job's own output on this branch rather than computed blind.
3 participants
Summary
npm auditreports all four direct dependencies and@vitest/browserclear. The total drops from 21 findings to 15; the remaining builder findings are addressed independently in #243.Related issue
Related to #243 (independent security update for the packaging toolchain).
Type of change
Release impact
Desktop impact
Screenshots / video
Not applicable; development dependency update only.
Testing
npm audit --json→ Vitest,@vitest/browser, Vite, PostCSS, and esbuild clearsrc/lib/exporter/audioTimeStretch.test.ts: 8/8 passednpm run build-viteusing Vite 7.3.6npm run wb:typechecknpm run lint(passes with the repository's 11 existing warnings)Summary by CodeRabbit