Skip to content

chore(webview): bump vulnerable transitive dependencies - #958

Merged
dividedmind merged 1 commit into
mainfrom
chore/bump-webview-deps
Aug 14, 2026
Merged

chore(webview): bump vulnerable transitive dependencies#958
dividedmind merged 1 commit into
mainfrom
chore/bump-webview-deps

Conversation

@dividedmind

Copy link
Copy Markdown
Contributor

Resolve every advisory reported by yarn npm audit -R that has a fix available within the ranges our dependents declare, then rebuild the bundle:

All of these are transitive and satisfied by the existing dependent ranges, so only the lockfile changes.

Still outstanding, blocked on upstream: vue and vue-template-compiler 2.7.16 (GHSA-5j4c-8p2g-v4jx, GHSA-g3ch-rx76-35fx) have no fix in the 2.x line and @appland/components does not support Vue 3; the deprecation warnings for @types/form-data, crypto-js and lucide-vue come from @appland/client, @appland/models and @appland/components respectively.

Assisted-by: Claude:claude-opus-5[1m]

Resolve every advisory reported by `yarn npm audit -R` that has a fix
available within the ranges our dependents declare, then rebuild the
bundle:

- brace-expansion 5.0.8 -> 5.0.9: GHSA-rgw5-rvv9-x895
- dompurify 3.4.12 -> 3.4.13: GHSA-55q2-fjhq-7xh7
- ip-address 10.2.0 -> 10.5.0: GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh,
  GHSA-22jq-vg5j-6vgg
- js-yaml 4.2.0 -> 4.3.1: GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
- mermaid 10.9.6 -> 10.9.8: GHSA-c4c3-pg64-4m4v, GHSA-6x64-9x62-f2gx,
  GHSA-2v8p-3f2j-5mp7
- nanoid 3.3.15 -> 3.3.18: GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
- postcss 8.5.15 -> 8.5.26: GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp
- socket.io-parser 4.2.6 -> 4.2.7: GHSA-2m8v-j782-fhvr

All of these are transitive and satisfied by the existing dependent
ranges, so only the lockfile changes.

Still outstanding, blocked on upstream: vue and vue-template-compiler
2.7.16 (GHSA-5j4c-8p2g-v4jx, GHSA-g3ch-rx76-35fx) have no fix in the 2.x
line and @appland/components does not support Vue 3; the deprecation
warnings for @types/form-data, crypto-js and lucide-vue come from
@appland/client, @appland/models and @appland/components respectively.

Assisted-by: Claude:claude-opus-5[1m]
@dividedmind
dividedmind requested review from kgilpin and a lite review from Copilot August 14, 2026 13:15
@dividedmind dividedmind self-assigned this Aug 14, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@dividedmind
dividedmind merged commit 948eb2a into main Aug 14, 2026
5 checks passed
@dividedmind
dividedmind deleted the chore/bump-webview-deps branch August 14, 2026 15:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants