fix(security): close open npm Dependabot vulnerability alerts - #868
Open
santoshkumarradha wants to merge 3 commits into
Open
fix(security): close open npm Dependabot vulnerability alerts#868santoshkumarradha wants to merge 3 commits into
santoshkumarradha wants to merge 3 commits into
Conversation
Bump transitive overrides across web client, desktop, TypeScript SDK, and mastra-bench lockfiles: - brace-expansion → 1.1.18 / 2.1.4 / 5.0.9 (CVE-2026-14257, CVE-2026-69152) - postcss → 8.5.25 (GHSA-fxqj-rqcc-2cmp incomplete sourceMappingURL fix) - fast-uri → 3.1.5 (backslash authority host confusion) - undici → 6.28.0 (cookie injection, retry desync, CRLF blob type) Closes Dependabot alerts #355, #357, #363, #365, #366, #370, #371, #372, #373, #375, #376. Supersedes #855 and #866. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
Contributor
Performance
⚠ Regression detected:
|
Contributor
📊 Coverage gateThresholds from
✅ Gate passedNo surface regressed past the allowed threshold and the aggregate stayed above the floor. |
Contributor
📐 Patch coverage gateThreshold: 80% on lines this PR touches vs
✅ Patch gate passedEvery surface whose lines were touched by this PR has patch coverage at or above the threshold. |
npm ci on alpine intermittently omits lightningcss-linux-*-musl when the lockfile lacks libc metadata, breaking vite build in functional-test image builds. Use glibc Node images for the UI builder stages instead. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
Keep postcss ^8.5.25 / brace-expansion 1.1.18+2.1.4 after #866 landed overlapping web-client dependency bumps on main. Co-authored-by: Santosh kumar <santoshkumarradha@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Single PR that upgrades all currently selected open Dependabot-alerted npm packages so the security alerts can auto-close once merged.
High
brace-expansion(web client locks)1.1.16/2.1.2→1.1.18/2.1.4fast-uri(desktop, mastra-bench)3.1.4→3.1.5Also patches desktop
brace-expansionlines1/2/5→1.1.18/2.1.4/5.0.9(same advisories).Moderate
postcss(web client, desktop, sdk/typescript)8.5.18→8.5.25undici(desktop)6.27.0→6.28.0CI reliability
UI Docker builder stages (
Dockerfile.control-plane,-cloud, functionalDockerfile.test-runner) switched fromnode:*-alpineto bookworm/glibc so Vite'slightningcssoptional native binding stops flaking undernpm cion musl.Merged
mainafter #866 landed; keptpostcss@8.5.25over #866’s8.5.24and retained brace-expansion overrides.Supersedes #855. Partially overlaps merged #866 (extends it with remaining alerts).
Type of change
Test plan
brace-expansion1.1.18/2.1.4/5.0.9,postcss8.5.25,fast-uri3.1.5,undici6.28.0)npm audit/pnpm auditno longer report the targeted advisoriesvite buildsucceededRelated issues / PRs