Skip to content

Fix all Dependabot security vulnerabilities#33

Merged
pacu merged 11 commits into
mainfrom
fix-dependabot-alerts
Apr 20, 2026
Merged

Fix all Dependabot security vulnerabilities#33
pacu merged 11 commits into
mainfrom
fix-dependabot-alerts

Conversation

@pacu
Copy link
Copy Markdown
Contributor

@pacu pacu commented Apr 20, 2026

Summary

Resolves all 50+ open Dependabot security alerts by upgrading vulnerable dependencies.

  • Bumped next from 16.1.5 to ^16.2.3 (resolves to 16.2.4) — direct dependency
  • Pinned the following transitive dependencies via pnpm.overrides:
Package Previous Fixed
dompurify 3.2.5 3.4.0
picomatch 2.3.1 2.3.2
lodash-es 4.17.21 4.18.0
@xmldom/xmldom 0.9.8 0.9.9
yaml 2.7.1 2.8.3
tar 7.4.3 7.5.11
minimatch 10.0.3 10.2.3
@isaacs/brace-expansion 5.0.0 5.0.1
mdast-util-to-hast 13.2.0 13.2.1

Each fix is a separate commit for traceability.

Test plan

  • Verify CI/build passes
  • Confirm Dependabot alerts are dismissed after merge

🤖 Generated with Claude Code

pacu and others added 11 commits April 20, 2026 17:33
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Next.js auto-applied mandatory changes on first run:
- jsx changed from "preserve" to "react-jsx" (React automatic runtime)
- Added ".next/dev/types/**/*.ts" to include paths

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant