Fix open Dependabot alerts - #5
Merged
Merged
Conversation
Most of the open alerts were held open by the overrides block itself: hono, fast-uri and postcss were pinned to ranges that had since fallen below the patched versions, so no update could reach them. Drop those three and let the resolver take the current patches. Bump vitest past the RCE advisory and vite past the dev-server ones, then refresh the vulnerable transitives: postcss, ws, esbuild, qs, body-parser, fast-uri and hono. Replace the @hono/node-server pin with ^2.0.5, which pulls a patched hono. Keep the ip-address override: unlike the others it is still holding back a moderate advisory reachable through @modelcontextprotocol/sdk > express-rate-limit. pnpm audit reports no known vulnerabilities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dkanas
force-pushed
the
fix/dependabot-alerts
branch
from
July 29, 2026 15:10
836b9e9 to
ea0de96
Compare
gmile
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all 23 open Dependabot alerts.
pnpm auditreports no known vulnerabilities. Released as 0.5.1.Most alerts were held open by the
overridesblock itself —hono,fast-uriandpostcsswere pinned to ranges that had fallen below the patched versions, so nothing could update past them. Those three are dropped.vitest^3.2.4→^4.1.0(clears the critical advisory)vite^7.3.3→^7.3.5(dev-server advisories)@hono/node-serveroverride →^2.0.5, which pulls a patchedhonopostcss,ws,esbuild,qs,body-parser,fast-uri,honoThe
ip-addressoverride stays. Unlike the others it is not stale — it still holds back a moderate advisory reachable via@modelcontextprotocol/sdk>express-rate-limit; removing it reintroduces the vuln.Only devDependencies changed, so the published dependency contract is unchanged — hence a patch. vitest 4 is a major bump: 34 files / 159 tests pass, plus typecheck, build and lint.
Supersedes #2 and #3.
🤖 Generated with Claude Code