Skip to content

fix(deps): resolve open Dependabot alerts across npm manifests - #319

Merged
kauereinbold merged 3 commits into
mainfrom
fix/dependabot-alerts
Jul 26, 2026
Merged

fix(deps): resolve open Dependabot alerts across npm manifests#319
kauereinbold merged 3 commits into
mainfrom
fix/dependabot-alerts

Conversation

@kauereinbold

Copy link
Copy Markdown
Owner

Summary

  • React app: next bumped to 15.5.21+, overrides for sharp (>=0.35.0) and brace-expansion (>=5.0.8): 0 vulnerabilities
  • Blockchain: targeted overrides for axios, immutable, fast-uri, adm-zip, brace-expansion; hardhat-toolbox pinned to hh2 tag (npm latest tag is incompatible with Hardhat 2). Remaining low/moderate audit items are deep web3 toolchain deps with no fixed versions (elliptic *)
  • Cypress: systeminformation patched via npm audit fix: 0 vulnerabilities

Closes #318

Test plan

  • React: 70 tests pass, production build green
  • Blockchain: 10 hardhat tests pass
  • CI workflows green

React app: next 15.5.21+, sharp/brace-expansion overrides.
Blockchain: overrides for axios, immutable, fast-uri, adm-zip,
brace-expansion; hardhat-toolbox pinned to hh2 tag (latest tag
broke Hardhat 2). Cypress: systeminformation patched.

All suites pass: react 70, hardhat 10, react build green.

Closes #318
Lockfile has pre-existing hardhat-ignition-ethers peer mismatch; npm ci
enforces strict peers and fails in CI without it.
Node 18 is EOL and unsupported by Hardhat; hardhat-ignition-ethers is
ESM-only and needs require(esm) support from Node 20+.
@kauereinbold
kauereinbold merged commit 6c6d1ea into main Jul 26, 2026
8 of 9 checks passed
@kauereinbold
kauereinbold deleted the fix/dependabot-alerts branch July 28, 2026 13:28
kauereinbold added a commit that referenced this pull request Aug 9, 2026
* fix(deps): resolve open Dependabot alerts across npm manifests

React app: next 15.5.21+, sharp/brace-expansion overrides.
Blockchain: overrides for axios, immutable, fast-uri, adm-zip,
brace-expansion; hardhat-toolbox pinned to hh2 tag (latest tag
broke Hardhat 2). Cypress: systeminformation patched.

All suites pass: react 70, hardhat 10, react build green.

Closes #318

* fix(blockchain): add .npmrc legacy-peer-deps so npm ci matches lockfile

Lockfile has pre-existing hardhat-ignition-ethers peer mismatch; npm ci
enforces strict peers and fails in CI without it.

* ci: bump Node 18 to 22 in npm workflows

Node 18 is EOL and unsupported by Hardhat; hardhat-ignition-ethers is
ESM-only and needs require(esm) support from Node 20+.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(deps): resolve 22 open Dependabot alerts across npm manifests

1 participant