deps: resolve all 22 open Dependabot alerts - #16
Open
Mbareck21 wants to merge 1 commit into
Open
Conversation
Refresh the lockfile onto patched versions and add a sharp override. - next 15.5.20 -> 15.5.23 (8 alerts: SSRF in rewrites/Server Actions, Server Action DoS, cache confusion, image-optimization SVG DoS) - next-auth 4.24.14 -> 4.24.15 (3 alerts, incl. critical homoglyph @ bypass in the email normalizer) - sharp 0.34.5 -> 0.35.3 via overrides (libvips CVEs; next pins ^0.34.3 so it cannot float on its own) - ip-address 10.2.0 -> 10.5.0 (3 SSRF / trust-boundary bypasses) - postcss 8.5.16 -> 8.5.26 (sourceMappingURL path traversal) - nanoid 3.3.15 -> 3.3.18, brace-expansion 1.1.15 -> 1.1.18, js-yaml 4.3.0 -> 4.3.1 (DoS) Direct-dep floors in package.json bumped so fresh installs cannot regress. npm audit reports 0 vulnerabilities; next build passes.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all 22 open Dependabot alerts.
Seven of the eight packages only needed a lockfile refresh — their existing ranges already admitted the patched versions.
sharpwas the exception:nextdeclaressharp: ^0.34.3, and a caret on a0.xversion never crosses to0.35, so it can't float. It's pinned via a newoverridesentry.@bypass in the email normalizersourceMappingURLpath traversal!!omapChanges
package.json— direct-dep floors raised (next,next-auth,postcss,eslint-config-next) so a fresh install can't regress, plus"sharp": "^0.35.0"inoverrides.package-lock.json— regenerated.No source files touched.
Verification
npm audit→ 0 vulnerabilitiesnpm run build→ compiles clean, all 10 routes generateNote on brace-expansion
The tree carries two independent lines: 1.x under
minimatch(prod) and 5.x under@typescript-eslint/typescript-estree(dev). Only the 1.x line was vulnerable and it floats to a patched version on its own. A blanketbrace-expansionoverride would force the 5.x consumer down to 1.x and break it — deliberately not done.