build(deps): resolve open Dependabot security alerts - #636
Conversation
Covers every open Dependabot alert on the repo, and supersedes the open Dependabot PR #616. - next 16.2.4 -> 16.2.12 in apps/demo-next and packages/sdk-next (alerts #172-#180, patched in 16.2.11). This is what #616 did. - @hono/node-server 1.19.14 -> 1.19.17 via override (alert #159, GHSA-frvp-7c67-39w9). Pulled in transitively by @modelcontextprotocol/sdk <- @fumapress/ai. The advisory records 2.0.5 as the first patched release, but the fix was backported to the 1.x line in 1.19.15, so we stay on 1.x instead of forcing a major on a transitive we do not control. - esbuild 0.27.7 -> 0.28.1 via override (alert #71, GHSA-g7r4-m6w7-qqqr). Reached through orval, tsup, tsx and vite 7; vite 8 already resolved 0.28.1, so this only dedupes the tree.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
There was a problem hiding this comment.
Pull request overview
Resolves outstanding Dependabot security alerts by bumping vulnerable dependency versions (direct and transitive) and updating the workspace lockfile accordingly.
Changes:
- Bump
nextto^16.2.11(resolving to16.2.12in the lockfile) forapps/demo-nextand as a devDependency forpackages/sdk-next. - Add
pnpm.overridespins for@hono/node-server(^1.19.17for the affected 1.x range) andesbuild(^0.28.1for the affected range). - Update
pnpm-lock.yamlto reflect the new resolved versions and deduping.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds pnpm.overrides entries to force patched @hono/node-server and esbuild versions. |
| apps/demo-next/package.json | Updates next dependency range to pick up patched releases. |
| packages/sdk-next/package.json | Updates next devDependency range used for SDK development/build/test. |
| pnpm-lock.yaml | Lockfile refresh reflecting updated next, @hono/node-server, esbuild, and related transitive resolution changes. |
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
| "eslint-plugin-testing-library": "^7.0.0", | ||
| "jsdom": "catalog:", | ||
| "next": "^16.2.4", | ||
| "next": "^16.2.11", |
Summary
Clears every open Dependabot security alert on
zitadel/nextgen(11 at time of writing) and folds in the one open Dependabot dependency PR, #616, so this can land as a single change.next16.2.4→16.2.12inapps/demo-next+packages/sdk-next@hono/node-server1.19.14→1.19.17via rootpnpm.overridesesbuild0.27.7→0.28.1via rootpnpm.overridesNotes on the two transitive ones:
@hono/node-server— reached via@fumapress/ai→@modelcontextprotocol/sdk(docs tooling only; the advisory is a Windows-onlyserve-staticpath traversal). The GHSA records2.0.5as the first patched release, but upstream backported the sameserve-staticguard to the 1.x line in1.19.15— so this pins^1.19.17rather than forcing a cross-major bump on a transitive we do not control. The existing>=2.0.0 <2.0.10override is untouched.esbuild— reached viaorval,tsup,tsxandvite@7.vite@8already resolved0.28.1, so forcing^0.28.1mostly just dedupes the tree (net ~360 fewer lockfile lines, 26 platform packages dropped).Validation
pnpm installpnpm check --only node— pass (moon ci :lint :typecheck :build :test)pnpm exec moon run demo-next:build sdk-next:build sdk-next:test --force— pass, to confirm thenextbump and the forcedesbuildversion specificallynext@16.2.4, no@hono/node-server@1.19.14, noesbuild@0.27.7remainRelease notes / changeset
No changeset required — no shipped behavior changed. The
nextbumps are adevDependencyinpackages/sdk-next(peer range stays>=14) and a dependency of the non-publishedapps/demo-next; the overrides only affect dev/build tooling.Notes
BEHINDand targets16.2.11; this lands16.2.12. Close it once this merges.<zl-gate>atom, null-safe invisible atoms, mock gate verification #159 may not auto-close: GitHub's advisory range is still< 2.0.5, so1.19.17keeps matching it even though it carries the fix. It will need a manual dismissal ("a fix has already been started") or a wait for upstream to widen the range.sharp, high) is already manually dismissed, fix: scaffold next.js middleware so /__nextgen routes are wired up #157/feat: implement SessionRepository with token minting and rotation #130 are auto-dismissed.