fix(deps): resolve 17 Dependabot advisories — vite, react-router, @babel/core (LAC-3048) - #487
Merged
Merged
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
…visories (LAC-3048) - vite 6.3.5 -> 6.4.3 (GHSA-fx2h-pf6j-xcff server.fs.deny bypass, GHSA-v6wh-96g9-6wx3 launch-editor NTLM hash disclosure) - react-router / react-router-dom 7.6.3 -> 7.18.1 (GHSA-49rj-9fvp-4h2h turbo-stream RCE, GHSA-rxv8-25v2-qmq8 + GHSA-8x6r-g9mw-2r78 DoS, GHSA-2j2x-hqr9-3h42 open redirect, GHSA-f22v-gfqf-p8f3 stored XSS); vendored turbo-stream v2 removed from tree - @babel/core 7.28.0 -> 7.29.7 in bun.lock and backend-server lockfile (GHSA-4x5r-pxfx-6jf8 arbitrary file read) - reasoning.tsx: stop spreading CollapsibleContent props into Streamdown (streamdown 2.5 tightened dir prop type; double-spread was a latent bug) Co-Authored-By: Paperclip <noreply@paperclip.ing>
lacymorrow
force-pushed
the
LAC-3048/dependabot-dep-upgrades
branch
from
July 23, 2026 22:59
9e0e0ea to
e139fc9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves LAC-3048 — 17 open Dependabot alerts (10 high, 5 moderate, 2 low).
Triage findings
The 17 alerts collapse to 4 packages, double-counted across
pnpm-lock.yamlandpackage-lock.json— root lockfiles deleted from main in June 2025. GitHub's dependency graph retains stale manifest entries, so newly published advisories still fire against them. The alerts can never auto-resolve (nothing rescans deleted files), but the same vulnerable versions were genuinely present in the livebun.lock, so the upgrades are real fixes, not bookkeeping:server.fs.denybypass), GHSA-v6wh-96g9-6wx3 (moderate, NTLM hash disclosure) — both Windows dev-server onlybackend-server/package-lock.json(7.27.4 → 7.29.7, same advisory, not yet flagged)Collateral changes
bun installdeterministically refreshed other in-range transitive deps when package.json changed (streamdown 2.2→2.5, vitest 3.1→3.2.7, @vitejs/plugin-react 4.3→4.7). Any fresh install would produce the same resolution.reasoning.tsx: streamdown 2.5 tightened thedirprop type, exposing a latent bug — CollapsibleContent props were double-spread into bothCollapsibleContentandStreamdown. Removed the second spread (matches upstream ai-elements).Follow-up (not in this PR)
The 17 stale-manifest alerts will be dismissed with an explanatory comment after merge, since they reference deleted lockfiles and cannot auto-close.
Testing
bun run build(tsc + vite) — passesnpm test -- --run— 36/36 passcargo checknot applicable (npm-only diff)