build(deps): clear the open Dependabot security alerts - #660
Merged
Conversation
Six alerts are open against pnpm-lock.yaml. Two of them (liquidjs, react-server-dom-webpack) are catalog entries, so they move in pnpm-workspace.yaml; the rest are transitive and land as range-scoped pnpm.overrides, as the existing entries there do. - liquidjs 10.27.0 -> 10.27.2 (CVE-2026-55575) - react-server-dom-webpack 19.2.5 -> 19.2.8 (CVE-2026-44907), plus react/react-dom to 19.2.8: 19.2.8 peers on ^19.2.8, and React ships the RSC packages in lockstep - brace-expansion to 1.1.17 / 2.1.3 / 5.0.8 (CVE-2026-14257). The old override pinned 5.0.7, which the advisory now covers, so the bounds move rather than gaining a new entry - postcss to ^8.5.18 (GHSA-r28c-9q8g-f849, GHSA-frvp-7c67-39w9 predecessor GHSA at <= 8.5.11). Collapses the 8.4.31 copy pinned by next and the 8.5.15 copy from the build tooling into a single 8.5.25 - @hono/node-server to ^2.0.12 (GHSA-frvp-7c67-39w9). The vulnerable 1.19.17 comes from @modelcontextprotocol/sdk and has no 1.x patch; SDK 1.30.0 widened its range to ^1.19.9 || ^2.0.5, so the SDK is raised alongside to keep the 2.x pin within a declared range
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🦋 Changeset detectedLatest commit: 9640c08 The changes in this PR will be included in the next version bump. This PR includes changesets to release 19 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
There was a problem hiding this comment.
Pull request overview
Clears active Dependabot security alerts by updating workspace catalog entries and tightening root pnpm.overrides, plus adding a changeset for the runtime-shipped LiquidJS update.
Changes:
- Bump React / React DOM / RSC catalog versions to 19.2.8 to resolve the
react-server-dom-webpackadvisory and avoid unmet peers. - Update root
pnpm.overridesto remediate advisories for@hono/node-server,brace-expansion, andpostcss, and bump@modelcontextprotocol/sdkto a compatible patched range. - Add a changeset releasing patch updates for packages that ship
liquidjsat runtime (@zitadel/components,@zitadel/config).
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| pnpm-workspace.yaml | Updates catalog versions for liquidjs and the React/RSC stack. |
| package.json | Updates pnpm.overrides to address multiple transitive security advisories. |
| .changeset/security-dependency-updates.md | Declares patch releases for runtime dependency security updates. |
10.27.1 is the advisory's patched version, so the floor was already safe. Move it to 10.27.2 anyway: that release extends the same memoryLimit accounting to the join, json and inspect filters, and it is what the lock resolves and CI tests against, so the range published by @zitadel/config and @zitadel/components now matches it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pnpm-lock.yaml). Two are catalog entries and move inpnpm-workspace.yaml; the other four are transitive and land as range-scopedpnpm.overrides, matching the entries already there.liquidjs10.27.0 → 10.27.2 —popfilter bypassedmemoryLimitaccounting (CVE-2026-55575, docs: add architecture, definition rules, capabilities #182).react-server-dom-webpack19.2.5 → 19.2.8 — DoS in Server Functions (CVE-2026-44907, fix: preserve user input across validation errors #184); the old version is deprecated on npm.react/react-dommove to 19.2.8 with it: 19.2.8 peers on^19.2.8, and React ships the RSC packages in lockstep. Without this,apps/docsinstalls with an unmet peer (see Notes). No published-contract impact — only the private@zitadel/ui-reactusescatalog:for its React peers;sdk-react/sdk-nextpublish>=18.brace-expansion→ 1.1.17 / 2.1.3 / 5.0.8 — unbounded expansion OOM (CVE-2026-14257, fix: emit per-field validation block on flow step responses #185). The existing override pinned 5.0.7, which the new advisory covers, so the bounds move rather than gaining a new entry; the 1.x and 2.x backports landed 2026-07-28/29.postcss→^8.5.18—sourceMappingURLpath traversal (feat: added default user schema and flow definition #183, and Onboarding: First Value #181 for the earlier range). Collapses the 8.4.31 copy pinned bynext@16.2.12and the 8.5.15 copy from the build tooling into a single 8.5.25.@hono/node-server→^2.0.12—serve-staticpath traversal on Windows (feat(components):<zl-gate>atom, null-safe invisible atoms, mock gate verification #159). The vulnerable 1.19.17 comes from@modelcontextprotocol/sdk(via@fumapress/aiinapps/docs) and the advisory has no 1.x patch, so the SDK is raised to^1.30.0alongside — 1.30.0 widened its range to^1.19.9 || ^2.0.5, which keeps the 2.x pin inside a declared range instead of forcing one.Supersedes #639, which covered the first two but left
react/react-domat 19.2.5.Validation
corepack pnpm install --lockfile-only— resolves clean. Lock churn is confined to the affected trees (postcss family, brace-expansion,@modelcontextprotocol/sdk, nanoid); nothing else moved.nuxt/@nuxt/devtoolsvs vite 8,@angular/buildvs vitest 4) are pre-existing onmain.corepack pnpm install && corepack pnpm exec moon run :build :typecheck :test— 80 tasks, exit 0.Release notes / changeset
.changeset/security-dependency-updates.md— patch for@zitadel/componentsand@zitadel/config, which shipliquidjsas a runtime dependency. The rest of this PR is build-time orapps/docs-only and ships nothing.Notes
react/react-dombump:apps/demo-next(react: ^19.0.0) andpackages/sdk-next(>=18) are not catalog-managed and stay on 19.2.5 — deliberate, since those mirror a consumer app's own manifest.brace-expansion@>=3.0.0 <5.0.7stops matching once 5.0.7 is itself the vulnerable version. Worth a look whenever an alert reappears for a package that already has an entry.cli:testfailure was therelease-artifacts.test.tsassertion loosened onmainin 4c3a3ce (refactor(database): 1:1 UserTOTP statements Get/List/Delete filters #642) a day later, not the dependency bump..github/dependabot.ymlin the repo, so only security updates open PRs — no scheduled version updates. The catalog has drifted accordingly (72 of 104 entries behind latest: 15 patch, 41 minor, 16 major). Not addressed here.