Clear all 14 Dependabot advisories - #27
Merged
Merged
Conversation
All 14 are development scope: vite, postcss and fast-uri in the test toolchain. None ship to consumers of the published SDK. postcss and fast-uri are lifted with pnpm overrides. vite needed more: it is an auto-installed peer of vitest rather than a declared dependency, and pnpm will not apply an override to an auto-installed peer, so it stayed on 8.0.3 below the 8.0.5 patch line. Declaring vite explicitly as a devDependency resolves it to 8.2.1, well within vitest's ^8.0.0 peer range. Build clean and 480 unit tests pass. The wire tests need a mock server and were left to CI. Note: this repository is Fern-generated, so these changes are reverted by the next SDK regeneration unless the same versions are set upstream. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
vite is now a declared devDependency, so the override only produced a specifier mismatch between package.json and the lockfile, which failed pnpm install --frozen-lockfile in CI. Verified with a clean --frozen-lockfile install this time, matching CI. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
sidharth0612
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All 14 open advisories on this repository are development scope —
vite,postcssandfast-uriin the test toolchain. None reach consumers of the published SDK, but they count against the Vanta vulnerability tests.postcssandfast-uriare lifted withpnpm.overrides.viteneeded more than an override. It is an auto-installed peer of vitest rather than a declared dependency, and pnpm will not apply an override to an auto-installed peer — it stayed on 8.0.3, below the 8.0.5 patch line, even with the override in place. Declaringviteexplicitly as a devDependency resolves it to 8.2.1, comfortably inside vitest's^8.0.0peer range.Verified locally: build clean, 480 unit tests pass. The
wiretests need a mock server that is unavailable in my sandbox, so those are left for CI to confirm.agentmail-docs/fern/generators.yml. I did not make that upstream change because I could not verify from Fern's schema that thepackageJsonblock passespnpm.overridesthrough, and shipping an unverified generator change seemed worse than a known-temporary fix.🤖 Generated with Claude Code