chore(deps): clear the fixable dependabot vulnerability alerts - #788
Merged
Conversation
pnpm update refreshes every in-range transitive. Overrides force axios, postcss, and ws past advisories their parents still pin below, and apollo-fetch (unused since the LIP fetch moved to a runtime API route) leaves with its vulnerable node-fetch 1.x. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It performs a large, wide-ranging dependency re-resolution and introduces security-motivated overrides, which warrants final human review despite no concrete issues found in the manifest change itself.
Pull request overview
This PR focuses on reducing the repository’s Dependabot/pnpm audit vulnerability surface by updating dependency versions within allowed ranges, removing an unused vulnerable package, and applying targeted pnpm.overrides to force patched transitive versions that aren’t otherwise reachable.
Changes:
- Updated a broad set of direct dependencies/devDependencies to newer patch/minor versions (and some larger within-major updates) to pick up security fixes.
- Removed
apollo-fetchfrom dependencies (per PR description: unused since the runtime API route change). - Added
pnpm.overridesentries foraxios,postcss, andws@^8.0.0, and bumped@types/nodeto align with Node 24.
File summaries
| File | Description |
|---|---|
| package.json | Dependency and devDependency version updates; removal of apollo-fetch; adds pnpm.overrides for patched transitive versions; aligns @types/node with Node 24 runtime. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This was referenced Sep 7, 2026
rickstaa
added a commit
that referenced
this pull request
Sep 7, 2026
2.17.7 pulls the ESM-only htmlparser2 12, which crashes Vercel's function runtime at import and 500s every /api/ens-data call. The exact pin stops in-range refreshes from re-landing it (as #788's pnpm update silently did) until the runtime is confirmed >=20.19.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the bulk of the open Dependabot alerts (local
pnpm audit: 144 findings → 21).pnpm update: re-resolves every transitive within its declared range (axios, hono, js-yaml, brace-expansion, and ~80 more alerts).pnpm.overrides:axios ^1.18.0,postcss ^8.5.23(next pins 8.4.31 exactly),ws@^8 → ^8.21.3— patched versions their parents don't reach yet.apollo-fetch: unused since fix: change create a poll LIP fetch to cached runtime API call #712 moved the LIP fetch to a runtime API route; it pinned the vulnerablenode-fetch1.x.@types/node→ 24, matching the runtime.What remains and why: a dev-only cluster under
@graphql-codegenv2 and@lhci/cli(cleared by their major bumps, separate PR),elliptic/extract-zip(no patch exists — to be dismissed on GitHub), andsharp/uuid/decode-uri-component/cookie(need a next bump or risky major overrides — deferred).Verified under Node 24: lint, typecheck, 363/363 tests, production build, and
/api/ens-datareturning 200 on the built server.