chore: fix 13 dependabot alerts via pnpm overrides + remove stale docs lockfile - #1332
Merged
Conversation
…s lockfile Fixes 13 open Dependabot alerts: | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | #36 | shell-quote@1.8.4 (quadratic DoS in parse) | High | → 1.9.0 | | #37 | @hono/node-server@1.19.17 (path traversal in serve-static) | Medium | → 2.0.12 | | #40 | fast-uri@3.1.3 (host confusion via literal backslash) | High | → 3.1.5 | | #55 | brace-expansion@5.0.7 (OOM via unbounded expansion) | High | → 5.0.9 | | #25 | astro View Transition XSS | Medium | (stale lockfile) | | #27 | brace-expansion exponential DoS | High | (stale lockfile) | | #29 | astro XSS via transition directives | Low | (stale lockfile) | | #31 | astro XSS via renderHTMLElement | Medium | (stale lockfile) | | #33 | js-yaml YAML merge-key chains | High | (stale lockfile) | | #34 | svgo removeScripts bypass | High | (stale lockfile) | | #35 | sharp libvips CVEs | High | (stale lockfile) | | #41 | postcss sourceMappingURL path traversal | High | (stale lockfile) | | #54 | brace-expansion OOM | High | (stale lockfile) | The active docs workspace is at apps/cli-docs/ (post-PR #1254 monorepo restructure), but a stale docs/pnpm-lock.yaml referencing the old docs/ layout (astro 6.x, sharp 0.33/0.34) was still tracked. Removing it closes alerts #25, #27, #29, #31, #33, #34, #35, #41, #54. All four transitive-only fixes applied via pnpm.overrides in the root package.json — the existing shell-quote override (<1.8.4 → 1.8.4) was itself in the vulnerable range for alert #36, so it is bumped to <1.9.0 → 1.9.0. Verified: pnpm audit (prod-only) clean, pnpm run lint ✓, pnpm run check:deps ✓, pnpm test:unit 8760 passing.
The transitive overrides for `@hono/node-server@2.0.12` and `brace-expansion@5.0.9` (resolving dependabot alerts #37 and #55) both declare `engines.node: '>=20'`. To keep the published package's declared minimum consistent with what the lockfile actually installs, bump `engines.node` from `>=18.0` to `>=20.0` in both the root `package.json` and `packages/cli/package.json`. Update the live docs that reference the old Node 18 floor: - apps/cli-docs/src/content/docs/library-usage.md - apps/cli-docs/src/content/docs/migrating-from-v3.md - packages/cli/README.md (the auto-generated library-prereq block reads from `engines.node` via `generateLibraryPrereq()` in `generate-docs-sections.ts`, so it picked up the new floor automatically when regenerated). The dev floor (`devEngines.runtime >=22.15`) is unchanged — Node 22.15+ remains the development minimum. The standalone binary continues to bundle its own Node 22.15+ runtime.
Contributor
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes all 13 open Dependabot alerts. No GitHub security advisories are open.
Bumps the published package minimum to Node.js 20+ (from 18+) so the declared
engines.nodematches what the new transitive overrides (@hono/node-server@2.0.12,brace-expansion@5.0.9) actually install.Background
Post-merge of PR #1254 ("chore: pre-shape repo into pnpm-workspace monorepo layout"), the docs workspace moved from
docs/toapps/cli-docs/. The olddocs/package.jsonwas deleted, butdocs/pnpm-lock.yamlwas left tracked — referencing the obsolete Astro 6.x / Starlight 0.39 layout. This stale lockfile is the source of 9 of the 13 open alerts.The remaining 4 alerts are transitive vulnerabilities in the active root
pnpm-lock.yaml:shell-quote@1.8.4viareact-devtools-core@hono/node-server@1.19.17via@modelcontextprotocol/sdk@1.29.0→@hono/mcp→@mastra/client-jsfast-uri@3.1.3viaajv→ MCP SDK chainbrace-expansion@5.0.7viaminimatch→glob(via ultracite and @sentry/bundler-plugins)Changes
Delete
docs/pnpm-lock.yaml— orphaned lockfile from pre-monorepo layout; closes alerts feat: added codecov action #25, feat(dsn): add monorepo support with multi-DSN detection #27, feat(auth): add automatic token refresh using refresh_token #29, feat(issue): add short ID aliases for multi-project support #31, fix(ci): use Craft action directly instead of reusable workflow #33, fix(ci): correct Craft version tag (no v prefix) #34, fix(ci): wrap pre/post release commands in bash -c for proper variable expansion #35, ci(release): Fix changelog-preview permissions #41, docs: update command references from 'get' to 'view' and document -w flag #54.pnpm.overridesin rootpackage.jsonfor the 4 transitive alerts:The previous
shell-quote@<1.8.4 → 1.8.4override was itself vulnerable (alert #36:shell-quote <= 1.8.4is the vulnerable range, patched in 1.9.0), so it is bumped to<1.9.0 → 1.9.0.engines.nodebump 18 → 20 in rootpackage.jsonandpackages/cli/package.json, plus doc updates in:apps/cli-docs/src/content/docs/library-usage.mdapps/cli-docs/src/content/docs/migrating-from-v3.mdpackages/cli/README.md(the auto-generatedlibrary-prereqblock reads fromengines.nodeviagenerateLibraryPrereq()ingenerate-docs-sections.ts, so it picked up the new floor automatically).The dev floor (
devEngines.runtime >=22.15) is unchanged — Node 22.15+ remains the development minimum. The standalone binary continues to bundle its own Node 22.15+ runtime.Verification
pnpm audit --prod→ no known vulnerabilitiespnpm run check:deps✓pnpm run lint✓ (951 files)pnpm run typecheck✓pnpm test:unit→ 416 files, 8760 tests passing, 13 skippedReviewer notes
Pin rationale for
@hono/node-server@2.0.12— the patched minimum is 2.0.5, butpackages/cli/package.jsonalready declares"@hono/node-server": "^2.0.6"as a direct devDependency. Pinning to 2.0.12 (the latest 2.x available at PR time) keeps the override and the direct declaration in the same major line and avoids a near-term minor bump.2.0.5–2.0.11had no further advisories at the time of writing.Lockfile dedupe side effect —
shell-quote@1.10.0(already non-vulnerable, used bylaunch-editor) is consolidated to1.9.0because the override forces single-version resolution. No security regression;launch-editordoes not pin a shell-quote range narrower than what 1.9.0 satisfies.Node 18 deprecation — addresses the F1 SHOULD-FIX from the initial review. The
>=18.0floor had become inconsistent with the lockfile once the overrides pulled in@hono/node-server@2.0.12(engines>=20) andbrace-expansion@5.0.9(engines20 || >=22). Both packages are dev-only transitive deps, so the only users impacted are source-install users who run the CLI vianodeinstead of the standalone binary.devEngines.runtimealready required>=22.15, so development environments are unaffected.Note
pnpm audit(non-prod-only) flags one additional low-severity advisory —@ai-sdk/provider-utils@2.2.8(GHSA-866g-f22w-33x8, CVE-2026-8769, via @mastra/client-js) — that is not yet in Dependabot. Addressing it requires bumping @mastra/client-js to a newer major; left out of this PR to keep scope focused on the explicit GitHub security report.Comment
@sentry <feedback>on this PR to have Autofix iterate on the changes.