Repository navigation
Bump react-template frontend deps to close 6 CVEs - #3208
Open
terryozaki-wq wants to merge 1 commit into
Open
terryozaki-wq wants to merge 1 commit into
terryozaki-wq wants to merge 1 commit into
Conversation
Raises pnpm overrides (added to the workspace root package.json, where pnpm.overrides must live for it to take effect - confirmed via pnpm's own warning when it was mistakenly placed in client/package.json instead) plus a direct vite bump in client/package.json: - @modelcontextprotocol/sdk 1.30.0 -> 1.32.0 (CVE-2026-104850, CVE-2026-111767, GHSA-rvq5-wwqv-78pq, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw) - proxy-addr 2.0.7 -> 2.0.8 (CVE-2026-90711) - brace-expansion 5.0.9 -> 5.0.12 (CVE-2026-102276/102277/102278) - source-map-js 1.2.1 -> 1.2.2 (CVE-2026-93749) - undici 7.29.1 -> 7.30.1 - vite 8.2.2 -> 8.3.5 (resolves within the bumped ^8.3.3 range) Regenerated project/.../assets/pnpm-lock.yaml via a real `pnpm install` from the workspace root (not --no-frozen-lockfile, to avoid also dragging unrelated packages to their latest allowed versions) and rebuilt + committed the portals/ production bundle, matching this repo's established convention for react-template dependency updates (e.g. #2976). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps 6 vulnerable dependency versions still resolved in
project/platform__react-template's workspace:@modelcontextprotocol/sdkproxy-addrbrace-expansionsource-map-jsundiciviteThe first 5 are transitive, so they're pinned via
pnpm.overrides— added to the workspace rootpackage.json(project/.../assets/package.json), not theclient/member package, since pnpm explicitly warns that overrides placed in a workspace member have no effect.viteis a directclient/package.jsondevDependency bump.Lockfile regenerated via a real
pnpm installfrom the workspace root (not--no-frozen-lockfile, to avoid also dragging unrelated packages likereact/typescriptto their latest allowed versions as a side effect) — the resulting diff touches only these 6 packages plus their legitimate new transitive dependencies (nanoid,postcss, androlldownas vite's own bundler dependency).Also rebuilt and committed the
portals/production bundle, matching this repo's established convention for react-template dependency updates (e.g. #2976) — since that bundle is what's actually served, leaving it stale would mean the fix doesn't take effect in the shipped artifact.Test plan
pnpm installfrom the workspace root — clean, no errors.pnpm run build(tsc -b && vite build) — succeeds,✓ built in 310ms.🤖 Generated with Claude Code