Repository navigation
chore(deps): clear reachable advisories with in-range security releases - #9656
Merged
Merged
Conversation
- follow-redirects 1.16.2: cross-realm sensitiveHeaders arrays were dropped on redirect (GHSA-mrwp-f3q8-3g9p); reached through axios in the Daytona SDK and Twilio clients. - @hono/node-server 2.1.5: serveStatic double-decodes paths (GHSA-rmxm-3fg6-px4f); every 1.x is affected and the MCP SDK already accepts ^2.0.5. Sim's MCP server uses the Web-standard transport, so nothing serves through it today. - body-parser 2.4.0 (GHSA-27r3-jxmh-p828) and systeminformation 5.33.16 (Trigger.dev host metrics; GHSA-3f7j/4vjg/7648). - gray-matter's nested js-yaml 3.15.2 (GHSA-2883-xcg3-v3hh) and the vitest dev server's vite 8.3.5 (launch-editor / fs.allow advisories), refreshed in the lock only. bun audit: 45 -> 33. Remaining rows have no compatible fix or are tracked separately: msal-node (@azure/identity still requires ^6), better-auth (1.7 upgrade PR), zod (patched), pi's pinned undici 8.10.2, node-gyp's undici 6 (build-time only), and the previously triaged unreachable set.
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
 [Medium impact] The PR appears safe to merge; no blocking issue was found in the reviewable changes. SummaryRefreshes dependency overrides for security fixes and adds an explicit
Reviews (2) · Last reviewed commit: "fix(db): resolve @sim/db self-imports un..." · Reviewed by Greptile |
Vite 8.3 applies tsconfig paths only to files the tsconfig includes. packages/db excludes scripts/, so script modules and their tests lost the @sim/db/* mapping and fell through to package exports, which do not list them.
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security-only dependency refresh. Every version here is past the 7-day release-age gate and within the range its dependents already declare.
^2.0.5; Sim uses the Web-standard transport, so nothing serves through itbun audit: 45 → 33.Vite 8.3 follow-on
Vite 8.3 applies tsconfig
pathsonly to files the tsconfig includes.packages/db/tsconfig.jsonexcludesscripts/, so script modules lost the@sim/db/*mapping under vitest.packages/db/vitest.config.tsnow aliases@sim/db/the same way the tsconfig does. All 22 db unit test files pass locally.Not changed
@azure/identity4.14 still requires^6. The vulnerable auth-code flow isn't used by tedious's Azure auth.patches/zod@4.3.6.patch.Test plan
vitestruns on the new vite (MCP utils, content registry, MCP server route suites green)