Repository navigation
fix(deps): close the open Dependabot security alerts - #159
Merged
Merged
Conversation
Dependabot reported 37 open alerts on 2026-11-08, all transitive and all in the lockfiles: - undici 7.28.0 (pinned exactly by miniflare 4.20260730.0, ADR-0012's pin): a pnpm override to 7.30.2, documented in pnpm-workspace.yaml next to the sharp override. Alerts #5-#32 (GHSA-2m5v-pch6-74hx, GHSA-4w7w-5xrc-9h26, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c, GHSA-rfgv-xxqx-mfg5, GHSA-w293-vg96-wgc3, GHSA-4cwx-7wf7-3272 and the medium/low advisories patched in 7.29.0, 7.29.1 and 7.30.1). - undici 8.11.2 (astro -> unifont ^8.0.0): plain update to 8.12.4, alerts #21-#35 on the 8.x line. - seroval 1.6.8 (@tanstack/router-core ^1.6.7): plain update to 1.7.9 with seroval-plugins 1.7.8. Alerts #36 (GHSA-9wx9-5pv9-3349) and #37 (GHSA-f86p-h4j2-7qgj). This one ships in the Studio bundle inside @cloudhal/cli, hence the changeset. - rustls 0.23.45 -> 0.23.46: alerts #1-#4 (GHSA-c8m5-c952-6cm4, GHSA-h2v8-394m-p7vv, GHSA-w44r-93j7-qv28, GHSA-vp88-798v-h67f). cargo audit then reported two more, not surfaced by Dependabot: rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0382) and webpki-root-certs 1.0.9 -> 1.0.11 (RUSTSEC-2026-0383), plus the tokio unsoundness warning RUSTSEC-2026-0386 (1.53.2 -> 1.54.1). pnpm audit and cargo audit are clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>
This was referenced Nov 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the 37 open Dependabot security alerts (state on 2026-11-08), all transitive and all in the lockfiles, plus two Rust advisories that
cargo auditreports and Dependabot does not. No source changes.pnpm.overridesundici@<7.30.1inpnpm-workspace.yaml: miniflare 4.20260730.0 (ADR-0012's pin) pins undici exactly to 7.28.0, so a plain update cannot move it. Documented next to the existingsharpoverride, with the alerts and the removal condition.pnpm update(astro → unifont^8.0.0)@tanstack/router-core^1.6.7)cargo update -p rustlscargo update(RUSTSEC-2026-0382, found bycargo audit)cargo update(RUSTSEC-2026-0383, found bycargo audit)cargo update(RUSTSEC-2026-0386, unsoundness warning)Who depends on what: undici 7 only through miniflare (devDependencies), undici 8 only through astro's unifont, rustls only through jsonschema's reqwest. seroval is the one that reaches users: it is compiled into the Studio bundle that
@cloudhal/cliships, hence the patch changeset on@cloudhal/cli.Checked locally:
pnpm install --frozen-lockfile(lockfile up to date),pnpm why undici seroval(no version below the patched ones),pnpm auditandpnpm audit --prod(no known vulnerabilities),cargo audit(clean, no warnings),pnpm lint,pnpm typecheck,pnpm size:check,cargo clippy --workspace --all-targets --locked -- -D warnings, andapps/studio/test/approvals.test.tsx(a router-based screen, for the seroval bump). The remainingpnpm peers checkwarning (@cloudflare/workers-typesbelow wrangler 4.158's peer range) predates this PR and is a separate decision (see the deps-sweep hand-over).Dependabot alerts only resolve against
main: the count goes to 0 once this is merged, not on the PR. Verify after the merge with:Checklist
pnpm lint,pnpm typecheck,pnpm size:check,cargo clippypass locally;pnpm checkandcargo test --workspaceare left to CI (one machine, several sessions).changeset/security-alerts-2026-11.md(@cloudhal/clipatch)git commit -s, DCO)pnpm-workspace.yaml🤖 Generated with Claude Code