[dependabot]

Bumps joi from 17.13.7 to 17.13.8.

Commits

• 4ae6af9 17.13.8
• b3ed6fb Merge pull request #3153 from hapijs/fix/messages-proto-flat-v17
• 1d2001c chore: backport #3151
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-level lockfile update to a validation library with no direct code changes in this repo.

Overview
Updates the locked joi dependency from 17.13.7 to 17.13.8 in package-lock.json (patch release).

Per the upstream release notes, 17.13.8 backports a fix around validation messages and prototype handling (hapijs/joi #3153). No application source changes—only the resolved version, tarball URL, and integrity hash in the lockfile.

^{Reviewed by Cursor Bugbot for commit 635acae. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[hoffmang9]

@BugBot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 635acae. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verdict: benign

I'll review the joi 17.13.7 → 17.13.8 diff for supply-chain compromise, starting with the changed upstream files and the scanner report.The scanner only flags four files. I'll read the version-range diff and commit metadata next.The checkout is on a later major. I'll inspect the v17.13.8 tree itself so the review matches the published patch.

This is a one-patch security fix from the long-standing hapi maintainer, not a compromise. The range v17.13.7 (ed9d7cd) to v17.13.8 (4ae6af9) changes four files (+64/−1): lib/messages.js, package.json, test/base.js, and test/extend.js.

lib/messages.js rejects a message code named __proto__ in compile() and merge() so a flat or locale-scoped code cannot trip the legacy prototype setter and replace the messages object prototype. Tests assert that path throws Cannot use __proto__ as a message code. The 'pwned' strings are regression fixtures for that bug, not a payload. package.json only moves "version" from 17.13.7 to 17.13.8. Dependencies and scripts are unchanged, including the existing prepublishOnly browser build. No new transitive dependencies, lifecycle scripts, workflows, lockfiles, network calls, eval/Function, process or filesystem abuse, encoded payloads, or hidden Unicode.

The scanner result matches this reading: status clean, four files, and zero Unicode, confusable, IOC, and heuristic findings. Commits are by Nicolas Morel (nicolas@morel.io), the same author as the prior 17.13.x releases, on an annotated tag that points at 4ae6af9.

Compatibility Analysis

I'll review the joi 17.13.7 → 17.13.8 bump for compatibility: where this repo uses it, what the upstream change actually touches, and whether those overlap.The lockfile already pins joi at 17.13.8 as a Docusaurus transitive dependency. Next I’ll inspect the 17.13.7–17.13.8 diff and how this repo actually calls it.Merge. This patch stays inside the range Docusaurus already allows, and nothing in this repo hits the only behavior that changed.

Where joi is used

joi is not a direct dependency and no first-party code imports it. package.json does not list it. The lockfile resolves a single copy, joi@17.13.8, required as ^17.9.2 by:

• @docusaurus/types (config type schemas)
• @docusaurus/utils-validation (Docusaurus config and plugin-option validation)

Those run at docusaurus start / docusaurus build time. Site source (docusaurus.config.js, sidebars.js, src/) is plain config and theme code. Docs hits on joi are the substring in words like “join”, not the package.

Overlap with the 17.13.7 → 17.13.8 change

v17.13.7..v17.13.8 is four files (+64/−1): lib/messages.js, package.json (version only), and two tests. compile() and merge() now throw Cannot use __proto__ as a message code when a custom message key is __proto__ (flat or locale-scoped). That path is .messages(), prefs / validate messages, and Joi.extend({ messages }).

Exports, types, and Joi’s own dependency ranges are unchanged. This repo never passes custom message maps, and Docusaurus’s schemas use fixed message codes, so the new throw does not meet any call site here.

Risks

Low. The only new failure is a message code literally named __proto__, which is not used. Validation of normal config still behaves as in 17.13.7. Node >=24.14.1 is compatible with Joi 17. No browser-runtime or lockfile-range conflict: both parents already accept ^17.9.2.

---

Malware Scan Summary

• Status: clean
• Warn only mode: true
• Changed upstream files scanned: 4
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: ed9d7cdd11ef5f7751fd46886f38dc605c9c3995..4ae6af96f7990fdb336aa8ad7dee5e9f847d084a
• Resolved refs: from=ed9d7cdd11ef5f7751fd46886f38dc605c9c3995 to=4ae6af96f7990fdb336aa8ad7dee5e9f847d084a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 0

[ibutterbot]

Lockfile-only patch bump. Upstream fix is a prototype handling backport in joi's messages validation (hapijs/joi#3153). CI green.