chore(deps): apply 18 Dependabot security updates#455
Merged
Conversation
Resolves 32 of 52 npm audit advisories (all 3 critical, 10 of 18 high). Everything here is within the existing semver ranges, so it is a lockfile-only change with one exception: next. @react-email/preview-server declares an exact dependency on next 16.2.3, and because the root range (^16.1.7) also allowed 16.2.3, npm deduped the whole tree onto that one version. That held the app on a next with 13 high advisories, including middleware/proxy bypass and cache poisoning. Raising the root to ^16.2.11 stops the dedupe: the app gets 16.2.11 and preview-server keeps a private nested 16.2.3. That is safe because next is a regular dependency of preview-server rather than a peer dependency, and preview-server is a devDependency that runs as its own process via `npm run emails` -- it is imported nowhere in src and is not in the production bundle. Held back deliberately: - nodemailer 8 -> 9 (#446) and uuid 11 -> 14 (#429), both majors - sharp, which needs 0.35.x, outside the current ^0.34.4 range Verified with npm run lint, npm run build and the full unit suite (285 passed).
This was referenced Jul 22, 2026
joaquimds
added a commit
that referenced
this pull request
Jul 23, 2026
Three majors, but the only API used across the codebase is the
`import { v4 as uuidv4 } from "uuid"` named export, which is unchanged
throughout.
The breaking changes and why they are safe here:
- v12 removes CommonJS support. Both tsconfigs are module esnext with
moduleResolution bundler, there is no require("uuid") anywhere, and the
published SDK (tsconfig.api.json) does not use uuid.
- v13 makes browser exports the default, which relies on a global crypto.
- v14 requires node@20+ for that global crypto. CI runs node 22 on all
three workflows and local development is on node 22.
Verified with npm run lint, npm run build and the full unit suite (285
passed), which covers the tRPC routers and the webhook refresh job where
uuidv4 is used.
Stacked on top of the Dependabot batch (#455).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batches 18 of the 20 open Dependabot PRs into one change. Resolves 32 of 52 npm audit advisories — all 3 critical and 10 of 18 high.
What's here
All bumps sit inside the existing semver ranges, so this is a lockfile-only change except
next.The
nextbump needs a note@react-email/preview-serverdeclares an exact dependency onnext@16.2.3. Since the root range (^16.1.7) also allowed 16.2.3, npm deduped the entire tree onto that single version — so a dev-only email preview tool was holding the app on anextcarrying 13 high advisories (middleware/proxy bypass, cache poisoning, SSRF, XSS).Raising the root to
^16.2.11stops the dedupe. The app resolves 16.2.11; preview-server keeps a private nested 16.2.3.That is safe because:
nextis a regular dependency of preview-server, not a peer dependency, so duplication is allowed and each module resolves its own copy.src, run as a separate process vianpm run emails. The two copies never coexist in one process, and it is not in the production bundle.Held back deliberately
<=9.0.0), needs its own review of the email sending path.^0.34.4range. No Dependabot PR open.Verification
npm run lint(prettier, eslint,tsc --noEmit, madge) — cleannpm run build— succeedsnpm test -- run tests/unit— 285 passed, 15 skippedMerging this should auto-close the 18 batched Dependabot PRs; #446 and #429 stay open.
🤖 Generated with Claude Code