chore(deps): resolve all 10 open security alerts - #91
Conversation
npm audit fix plus two overrides for transitive pins that block patched versions: - sharp ^0.35.0 override (@huggingface/transformers pins ^0.34) - GHSA-f88m-g3jw-g9cj - adm-zip ^0.6.0 override (onnxruntime-node pins 0.5.x) - GHSA-xcpc-8h2w-3j85 - via audit fix: js-yaml 3.15.1, protobufjs 7.6.5, ip-address 10.4.0, @modelcontextprotocol/sdk 1.30.0 (brings @hono/node-server 2.0.12), brace-expansion and @babel/core to patched versions npm audit: 0 vulnerabilities. Lint, tests (532 passed), build, and bundle guard all green.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4361e670c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "sharp": "^0.35.0", | ||
| "adm-zip": "^0.6.0" |
There was a problem hiding this comment.
For npx, global installs, and applications that consume this published package, these overrides are ignored because npm states that overrides “are only considered in the root package.json.” The shipped package-lock.json does not govern consumer resolution either, so @huggingface/transformers can still resolve vulnerable sharp@^0.34.5 and onnxruntime-node can still resolve vulnerable adm-zip@^0.5.16, leaving the two high-severity alerts unfixed for users. Use a published-package mechanism such as upgrading/pinning the parent dependencies or shipping an appropriate shrinkwrap.
Useful? React with 👍 / 👎.
1 participant
Clears every open Dependabot security alert.
npm audit fixfor what semver reaches, plus twooverrides(existing house pattern) where upstream pins block the patched versions.^0.35.0-> 0.35.3 (@huggingface/transformers pins ^0.34)^0.6.0-> 0.6.0 (onnxruntime-node pins 0.5.x)Verified locally:
npm audit0 vulnerabilities; lint, tests (532 passed), build, and bundle-size guard all green.