Three open HIGH Dependabot alerts on main, all npm, all scope: development, all in app/package-lock.json:
#2 and #5 are two advisories against the same package; 4.3.1 clears both.
Exposure: none reachable
- browserslist needs an untrusted
browserslist-stats.json custom stats file. There is none in the repo, and no custom browserslist config.
- js-yaml needs attacker-controlled YAML (quadratic CPU via merge-key chains /
!!omap). The only thing openapi-typescript parses here is .local/openapi.generated.json — JSON, produced by scripts/gen_openapi.py from our own Pydantic models.
Neither ships in the built bundle. This is hygiene, not an incident.
Fixability differs
Both are transitive:
js-yaml@4.2.0 <- @redocly/openapi-core@1.34.17 <- openapi-typescript@7.13.0
browserslist@4.28.2 <- @babel/helper-compilation-targets <- @babel/core <- @preact/preset-vite
browserslist comes in via ^4.24.0, so npm update reaches 4.28.7.js-yaml is pinned exactly at 4.2.0 by @redocly/openapi-core. openapi-typescript is already on the latest (7.13.0), and the redocly release that moved to js-yaml ^5.2.2 (2.51.1) is not reachable from it. So there is no upgrade path — it needs an npm overrides entry.
Plan
npm update browserslist -> 4.28.7.overrides: { "js-yaml": "4.3.1" } in app/package.json, forcing past redocly's pin (4.2.0 -> 4.3.1 stays within 4.x).- Verify
just gen-types still produces byte-identical output (the generated manifest is checked by check-types-fresh) and the full suite passes.
Also: no remediation mechanism
There is no .github/dependabot.yml and no open Dependabot PRs. Alerts are on, but nothing opens update PRs, so these sit until someone notices a push warning — the same detection-without-remediation gap #209 closed for the image's OS packages.
Add weekly grouped update PRs for npm (app/), pip (the Python deps) and github-actions (workflow action versions). Each lands as a PR through the normal CI gate.
Three open HIGH Dependabot alerts on
main, all npm, allscope: development, all inapp/package-lock.json:browserslistjs-yamljs-yaml#2 and #5 are two advisories against the same package; 4.3.1 clears both.
Exposure: none reachable
browserslist-stats.jsoncustom stats file. There is none in the repo, and no custom browserslist config.!!omap). The only thing openapi-typescript parses here is.local/openapi.generated.json— JSON, produced byscripts/gen_openapi.pyfrom our own Pydantic models.Neither ships in the built bundle. This is hygiene, not an incident.
Fixability differs
Both are transitive:
browserslistcomes in via^4.24.0, sonpm updatereaches 4.28.7.js-yamlis pinned exactly at4.2.0by@redocly/openapi-core.openapi-typescriptis already on the latest (7.13.0), and the redocly release that moved tojs-yaml ^5.2.2(2.51.1) is not reachable from it. So there is no upgrade path — it needs an npmoverridesentry.Plan
npm update browserslist-> 4.28.7.overrides: { "js-yaml": "4.3.1" }inapp/package.json, forcing past redocly's pin (4.2.0 -> 4.3.1 stays within 4.x).just gen-typesstill produces byte-identical output (the generated manifest is checked bycheck-types-fresh) and the full suite passes.Also: no remediation mechanism
There is no
.github/dependabot.ymland no open Dependabot PRs. Alerts are on, but nothing opens update PRs, so these sit until someone notices a push warning — the same detection-without-remediation gap #209 closed for the image's OS packages.Add weekly grouped update PRs for npm (
app/), pip (the Python deps) andgithub-actions(workflow action versions). Each lands as a PR through the normal CI gate.