chore(deps): clear the open security advisories - #50
Conversation
- Runs `npm audit fix` on the frontend, which clears the critical `seroval` advisory and the rest of the non-breaking ones. - Runs `uv lock --upgrade` on the backend, picking up pillow 12.3.0, cryptography 50.0.0, urllib3 2.7.0, starlette 1.6.0, mako 1.4.1 and python-multipart 0.0.32. - The remaining frontend advisories all sit under `@hey-api/openapi-ts`, a codegen dev dependency, and need a breaking major bump. Left for a separate change.
…isories - Bumps `@hey-api/openapi-ts` from 0.95 to 0.99 and regenerates the client SDK. The generated public types are unchanged, so no application code needed touching. - 0.99 still resolves a vulnerable `js-yaml`, so pins it to ^4.3.1 through an override. - Pins `esbuild` to ^0.28.1 the same way, because vite 7.3.5 still resolves 0.27.7. - `npm audit` now reports zero vulnerabilities.
✅ Deploy Preview for climate-ref canceled.
|
|
Warning Review limit reached
Next review available in: 87 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (22)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Removes the `esbuild` override. It pinned above every declared consumer range to clear a low, dev-server-only, Windows-only advisory, which is outside the scope of this change. - Puts the changelog fragment in the past tense, as changelog/README.md asks for.
- ruff 0.16 promoted PLR0917 (too many positional arguments) out of preview, and the repo selects the whole `PL` group, so the lock bump turned it on. Every site it flags already carries a deliberate PLR0913 suppression, and none of them are ever called positionally, so the existing suppressions are extended rather than the rule being switched off repo-wide. - Moves the ruff pre-commit hook from v0.12.2 to v0.16.2 to match the locked version CI runs. The old hook did not know PLR0917, so it stripped the new codes back out as unused. That gap is why the failure only showed up in CI.
1 participant
Clears the open high and critical Dependabot alerts across both halves of the repo.
npm audit fixon the frontend, which clears the criticalserovaladvisory along with the other non-breaking ones.uv lock --upgradeon the backend, picking up pillow 12.3.0, cryptography 50.0.0, urllib3 2.7.0, starlette 1.6.0, mako 1.4.1 and python-multipart 0.0.32. Most of these are transitive through the climate-ref provider extras.@hey-api/openapi-tsfrom 0.95 to 0.99 and regenerates the client SDK.frontend/openapi.jsonis unchanged and the generated public types are identical, so every delta undersrc/clientcomes from the codegen bump rather than a backend spec drift, and no application code needed touching.js-yamlto ^4.3.1 through afrontend/package.jsonoverride, because@hey-api/json-schema-ref-parserpins it at exactly 4.2.0 and openapi-ts 0.99 therefore still resolves a vulnerable copy. The override can go once upstream moves, and Renovate will not remove it on its own.The lock bump is wider than the advisories strictly needed. It adds 35 new transitive packages and majors like cryptography 46 to 50, with no
pyproject.tomlchange. Tests pass on it.One low advisory is left unfixed: GHSA-g7r4-m6w7-qqqr, an arbitrary file read in the esbuild dev server on Windows. Clearing it needs an override above every declared consumer range, because vite 7.3.5 asks for esbuild ^0.27.0, and esbuild 0.x minors are breaking by convention. Not worth a semver-violating pin, because the only exposure is the dev server on Windows. Note that
viteis not purely a dev dependency here,@tailwindcss/vitepulls it on a runtime path, so the advisory shows up undernpm audit --omit=devtoo. The affected code path is still only ever reached by the dev server. It will clear when vite moves.Validation
pip-auditoveruv export --all-extrasreports no known vulnerabilities.tsc -bclean,vite buildclean,npm auditdown to the single low above.