chore(deps): OSV batch — clear all 21 known vulnerabilities across 8 packages - #3614
Merged
Conversation
…packages Direct bumps (published manifests, so downstream installs get the fixes): - apps/docs: next 16.2.10 → 16.2.11 (9 advisories incl. GHSA-6gpp-xcg3-4w24, GHSA-89xv-2m56-2m9x, GHSA-m99w-x7hq-7vfj, GHSA-p9j2-gv94-2wf4) - create-objectstack: tar ^7.5.20 → ^7.5.21 (GHSA-r292-9mhp-454m) - metadata: js-yaml ^5.2.1 → ^5.2.2 (GHSA-pm4m-ph32-ghv5) Workspace overrides for transitive-only advisories (no publishable package declares these, so the override-consistency gate is unaffected): - brace-expansion >=5.0.0 <5.0.8 → ^5.0.8 (via minimatch@10.x, GHSA-mh99-v99m-4gvg) - sharp <0.35.0 → ^0.35.0 (next optionalDep ^0.34.5 excludes the fix, GHSA-f88m-g3jw-g9cj) - react-router <8.3.0 → ^8.3.0 (GHSA-qwww-vcr4-c8h2 has no 7.x fix; fumadocs-core peer allows 8.x) - @sveltejs/kit <2.69.1 → ^2.69.1 (better-auth optional peer, GHSA-866w-xmhq-wj7x / GHSA-wqjv-9729-c5q2) - @hono/node-server <2.0.5 → ^2.0.10 (GHSA-frvp-7c67-39w9 has no 1.x fix; @modelcontextprotocol/sdk only imports getRequestListener, still exported by 2.x — dedupes onto the workspace's existing 2.0.10) react-router and @sveltejs/kit were optional peers pulled in by auto-install; re-resolution drops them from the graph entirely (the overrides remain as guards against future reintroduction). Verified: turbo build 72/72, turbo test 131/131, docs build + types:check (sharp 0.35.3 og-image generation exercised), check-override-consistency and check-changeset-fixed gates, MCP streamableHttp import smoke against node-server 2.0.10, and OSV querybatch over all 1453 lockfile packages — zero known vulnerabilities. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 12 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The non-required Validate Package Dependencies job (OSV-Scanner, runs on
pnpm-lock.yamlchanges) reports 21 known vulnerabilities across 8 packages (failing run). This PR clears all of them.Direct bumps (published manifests — downstream installs get the fixes)
Workspace overrides (transitive-only; no publishable package declares these, so the override-consistency gate is unaffected)
brace-expansion@>=5.0.0 <5.0.8 → ^5.0.8sharp@>=0.34.0 <0.35.0 → ^0.35.0^0.34.5excludes the fix (GHSA-f88m-g3jw-g9cj)react-router@<8.3.0 → ^8.3.07.x.x || 8.x.xand docs uses the next adapter@sveltejs/kit@<2.69.1 → ^2.69.1@hono/node-server@<2.0.5 → ^2.0.10^1.19.9and only importsgetRequestListener, still exported by 2.x — dedupes onto the workspace's existing 2.0.10Note: react-router and @sveltejs/kit were optional peers pulled in by auto-install; re-resolution drops both from the graph entirely (lockfile −119 lines). The overrides remain as guards against reintroduction.
Verification
turbo build72/72, fresh (no cache, dts typegen exercised)turbo test131/131 (a first-pass@objectstack/lint#testfailure was cross-contamination from a concurrently running docs build regenerating spec artifacts; clean rerun is green, 349/349 in that package)build(410+ pages prerendered; og-image generation exercises sharp 0.35.3) andtypes:checkwith next 16.2.11scripts/check-override-consistency.mjsandscripts/check-changeset-fixed.mjsboth passserver/streamableHttp.jsimport smoke against @hono/node-server 2.0.10🤖 Generated with Claude Code