Repository navigation
fix(deps): close all open Dependabot alerts - #77
Merged
Merged
Conversation
The example resolved undici 7.29.0, which ten advisories cover. Two are high severity: a TLS certificate validation bypass in BalancedPool and a denial of service through an unrequested WebSocket subprotocol. undici reaches the example as a transitive dependency of the AI SDK provider utilities. 7.29.1 is the first patched release and the declared range already admits it, so this updates the lock file alone.
vite-plugin-dts 4.x generates declarations through the API extractor, which pulls in argparse 1.x and in turn sprintf-js. An advisory covers every published sprintf-js release, so no version bump clears it. The package is a build-time development dependency and never handles untrusted format strings, but the alert cannot be resolved in place. vite-plugin-dts 5.x replaces the API extractor with unplugin-dts and so removes that chain. The plugin options in use are unchanged and the generated declaration files are byte-identical to the 4.x output. The example lock files record the linked root package's development dependencies, so they are regenerated to match.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe ChangesType declaration tooling update
Priority: ⬆️ High Change: Other Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly describes the dependency updates and the stated objective of resolving all open Dependabot alerts. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes every open Dependabot alert on the repository.
undici (10 alerts, 2 high)
examples/vercel-airesolved undici 7.29.0, which reaches the example transitively through@ai-sdk/provider-utils. The two high-severity advisories are a TLS certificate validation bypass inBalancedPooland a denial of service through an unrequested WebSocket subprotocol. The declared range (^7.28.0) already admits the first patched release, so this is a lock-file-only change to 7.30.1.sprintf-js (1 alert)
The advisory covers every published sprintf-js release, so no version bump clears it. The package arrives through
vite-plugin-dts4.x, which generates declarations with the Rushstack API extractor and so pulls inargparse1.x and then sprintf-js. It is a build-time development dependency and never sees untrusted format strings, but the alert cannot be resolved in place.vite-plugin-dts5.x replaces the API extractor withunplugin-dtsand removes that chain entirely. The plugin options in use (insertTypesEntry,copyDtsFiles) are unchanged.The example lock files record the linked root package's development dependencies, so all three are regenerated to keep them consistent.
Not changed
bracesis reported bynpm auditat high severity in all four lock files, but 3.0.3 is the latest published release and the advisory covers<=3.0.3, so no fix exists. It is development-only and Dependabot has already auto-dismissed those alerts.Verification
npm run lintpasses: Prettier, ESLint, and both typecheck projects.npm testpasses: 4 files, 106 tests.npm run buildsucceeds, and the generateddistoutput is byte-identical to the 4.x baseline, declaration files included.npm ciandnpm install --package-lock-onlyunder the pinned npm 11.19.1 leave the root lock file unchanged, so the lock-file freshness check in CI passes.npm auditreports no moderate or higher root advisory in any of the four lock files other than the unfixablebraces.Summary by CodeRabbit