chore(deps): resolve 49 of the 65 open dependabot alerts - #331
Merged
Conversation
dompurify is the only flagged package that ships to a visitor's browser, guarding dangerouslySetInnerHTML in the command palette and the CMS markdown preview. Fourteen advisories are open against 3.3.3. None are reachable with the config this repo uses, since every call site is a bare sanitize(html) with no hooks and no options, but that is thin cover for whoever adds a second argument later. Three overrides had been overtaken by newer advisories, and two were pinned against the wrong major: svgo@<3.3.3 did nothing about the 4.0.1 in the tree, and immutable@<4.3.8 did nothing about the 5.1.5 that sass pulls in. Both keep their old entry and gain a second one covering what is actually installed.
Thirteen packages had no override at all, and none of them ship to a visitor: postcss and sass build the stylesheets, js-yaml reads frontmatter, devalue serialises island props, and the rest is glob and spawn plumbing. Build-time is not the same as zero, though, since fork and CMS pull requests run the whole toolchain over content nobody has reviewed yet. sharp is the one worth a second look. astro declares it as an optional dependency at ^0.34.0, so pinning 0.35.0 crosses a major on a native module. This site never triggers image optimisation, which means a green build proves nothing either way. I exercised astro's sharp image service directly against the new version instead, and resize plus re-encode to webp, avif and jpeg all come back correct. esbuild is scoped as a range rather than a bare upper bound, because two copies sit in the tree and only 0.27.4 falls inside the advisory, so 0.25.12 is left where it is. The block is sorted by package name now. Twenty-nine entries in insertion order had reached the point where you could not tell at a glance whether something already had one.
There was a problem hiding this comment.
Pull request overview
This pull request updates dependency versions and tightens pnpm overrides to address a large portion of outstanding Dependabot alerts in a static Astro site, primarily by bumping two direct dependencies and pinning vulnerable transitive ranges to patched versions.
Changes:
- Bumped direct dependencies:
dompurifyand@astrojs/rss. - Refreshed/expanded
pnpm.overridesto cover additional vulnerable ranges (including multiple majors where needed), and reorganized the override set. - Updated
pnpm-lock.yamlaccordingly, reflecting the new resolutions across the dependency graph.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Updates dompurify / @astrojs/rss and expands pnpm.overrides to address alerts. |
| pnpm-lock.yaml | Regenerates the lockfile with the new direct versions and override-driven transitive resolutions. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sweeps the Dependabot queue. 49 of the 65 open alerts close with this. The other 16 are all astro, cannot be fixed on 5.x, and are written up at the bottom.
What was actually wrong
Dependabot marks 57 of these
runtimescope, which only means the package sits independenciesrather thandevDependencies. On a static site that says nothing about whether the code ever reaches a person. Exactly one flagged package ships to a browser:dompurify, guardingdangerouslySetInnerHTMLin the command palette on every public page and in the CMS markdown preview.Its 14 advisories all need a config this repo never passes. Every call site is a bare
sanitize(html), and there is noaddHook,setConfig,IN_PLACE,RETURN_DOM,SAFE_FOR_TEMPLATESorADD_TAGSanywhere insrc/. That is thin cover, though. Whoever adds a second argument later re-opens all fourteen without knowing it, so it gets bumped regardless of reachability.The overrides block had drifted too. Three pins were overtaken by newer advisories, and two pinned a major that is not installed:
svgo@<3.3.3did nothing about the 4.0.1 in the tree, andimmutable@<4.3.8nothing about the 5.1.5 that sass pulls in.What changed
Two direct bumps,
dompurifyto^3.4.13(resolves 3.4.14) and@astrojs/rssto^4.0.19. Then the overrides: three refreshed, two given a second entry covering the major that is actually installed, and thirteen added from scratch. The block is sorted by package name now, because 29 entries in insertion order had stopped being readable.Verification
Applied one package at a time, with
pnpm build,test:slugsandtest:pagesafter every single one. All 20 steps green, 303 pages and 193 assets throughout, andpnpm install --frozen-lockfileis clean.sharpneeded more than that. astro declares it optional at^0.34.0, so pinning 0.35.0 crosses a major on a native module, and this site never triggers image optimisation so the build exercises none of it. I ran astro's sharp image service directly against the new version instead: resize plus re-encode to webp, avif and jpeg all come back correct.Finally I cross-checked the resulting lockfile against every alert's vulnerable range with semver, rather than trusting that a bump landed where I meant it to. 49 resolved, 16 remaining, all astro.
The 16 astro alerts
Eight advisories, each counted twice because Dependabot reports a direct dependency against both
package.jsonandpnpm-lock.yaml. Every fix lands in 6.x or 7.x with no backport to 5.x, and 5.18.2, the last 5.x release, still sits inside all eight ranges.None of them can fire here:
CVE-2026-54299Host header SSRFoutput: "static", nothing serves a requestCVE-2026-50146reflected XSS via slot nameCVE-2026-73422view transition animation propertiesCVE-2026-59727transition:*on hydrated islandsCVE-2026-54298,CVE-2026-59729spread attribute namesseoobject, so attribute names are not attacker-controlledCVE-2026-41067define:vars</script>escapingCVE-2026-45028server island replayserver:deferanywhereWhether to dismiss those as not-applicable or leave them sitting in the queue is a call for someone else to make. Upgrading to Astro 7 to silence them is a far bigger change than this PR, and the constraint in the project notes says 5.x for now.
Alerts only clear once this lands on
main.