fix(deps): patch 68 security vulnerabilities and update packages#8
Open
jacksonkasi1 wants to merge 6 commits intomainfrom
Open
fix(deps): patch 68 security vulnerabilities and update packages#8jacksonkasi1 wants to merge 6 commits intomainfrom
jacksonkasi1 wants to merge 6 commits intomainfrom
Conversation
Security fixes (bun overrides + direct bumps): - hono -> 4.12.16 (GHSA-r5rp-j6wh-rvv4, GHSA-wmmm-f939-6g9c, GHSA-92pp-h63x-v22m, others) - @aws-sdk/client-s3 + presigner -> 3.1039.0 (pulls fixed fast-xml-parser) - fast-xml-parser override -> ^5.3.4 (GHSA-m7jm-9gc2-mpf2 critical, GHSA-jmr7-xgp7-cmfj, others) - axios -> ^1.15.2 (GHSA-r4q5-vmmm-2653 via follow-redirects) - better-auth -> ^1.6.9 - drizzle-orm -> ^0.45.2, drizzle-zod -> ^0.8.3 - vite -> ^7.3.2 (GHSA-mw96-cpmx-2vgc via rollup) Root overrides added for transitive vulns: seroval, path-to-regexp, picomatch, undici, srvx, rollup, flatted, minimatch, brace-expansion, kysely, socket.io-parser, postcss, uuid, qs, esbuild, @hono/node-server, follow-redirects Package updates: - prettier -> ^3.8.3, turbo -> ^2.9.6 (root devDeps) - @react-email/components -> ^1.0.12, react-email -> ^5.2.11 - @react-email/render -> ^2.0.8 - @t3-oss/env-core -> ^0.13.11, zod -> ^4.4.1, nanoid -> ^5.1.9
Reviewer's GuideMonorepo-wide dependency maintenance PR that adds a root-level overrides block to enforce patched versions of vulnerable transitives, bumps direct dependencies (including hono, axios, vite, AWS SDK, drizzle, better-auth, react-email stack), and updates dev tooling (prettier, turbo), bringing Bun audit vulnerabilities from 82 down to 14 residual issues confined to non-production/tooling paths. Flow diagram for Bun dependency resolution with root overrides and audit outcomeflowchart TD
A["bun_install or bun_update"] --> B["read root package_json"]
B --> C["detect workspaces apps_and_packages"]
C --> D["resolve direct_dependencies"]
D --> E["apply root_overrides block"]
subgraph overrides
O1["@hono_node-server ^1_19_10"]
O2["axios ^1_15_2"]
O3["fast-xml-parser ^5_3_4"]
O4["follow-redirects ^1_15_12"]
O5["undici ^7_24_0"]
O6["rollup ^4_59_0"]
O7["vite ^7_3_2"]
O8["esbuild ^0_25_10"]
O9["postcss ^8_5_10"]
O10["minimatch ^10_0_3"]
O11["brace-expansion ^2_0_3"]
O12["uuid ^14_0_0"]
O13["seroval ^1_5_0"]
O14["kysely ^0_28_16"]
O15["socket_io-parser ^4_2_6"]
O16["srvx ^0_11_13"]
O17["path-to-regexp ^8_4_0"]
O18["picomatch ^4_0_4"]
O19["flatted ^3_4_0"]
O20["qs ^6_15_0"]
end
E --> F["lock patched transitive_versions"]
F --> G["write bun_lock"]
G --> H["bun_audit before_overrides 82_vulnerabilities"]
H --> I["apply overrides and direct_bumps"]
I --> J["bun_audit after_changes 14_vulnerabilities"]
J --> K["residual_issues confined to tooling_and_experimental_paths"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (12)
📝 WalkthroughWalkthroughThe pull request updates dependencies across the monorepo, including bumping versions for packages like Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 51 minutes and 28 seconds.Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- For the root
overridesblock, consider pinning exact versions instead of using^ranges so the security posture stays stable and future dependency releases don’t silently change what’s being installed. - You might want to scope some of the more invasive overrides (e.g.,
minimatch,esbuild,vite) to the specific workspaces that require them rather than the monorepo root to reduce the risk of unexpected behavior in unrelated packages.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- For the root `overrides` block, consider pinning exact versions instead of using `^` ranges so the security posture stays stable and future dependency releases don’t silently change what’s being installed.
- You might want to scope some of the more invasive overrides (e.g., `minimatch`, `esbuild`, `vite`) to the specific workspaces that require them rather than the monorepo root to reduce the risk of unexpected behavior in unrelated packages.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Add missing root overrides: - minimatch ^10.0.3 -> ^10.2.1 (was still in advisory range GHSA-*) - @isaacs/brace-expansion -> ^5.0.1 - @modelcontextprotocol/sdk -> ^1.26.0 (GHSA-345p-7cg4-v4c7) - defu -> ^6.1.7 - ajv -> ^8.18.0 Remaining 6 all from h3 >=2.0.0 <=2.0.1-rc.14 (pulled by nitro / @tanstack/react-start); no stable patched release available upstream.
…ariable - Remove unused `Navigate` import in Dashboard.tsx - Remove console.error debug statements from axios response interceptor - Align axios baseURL env var with auth-client (VITE_API_BASE_URL) - Use bare `catch` instead of `catch (error)` where error is unused in delete-file.ts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move `// ** import types` before `// ** import lib` in ProtectedRoute.tsx - Collapse misplaced `// ** import utils` section into `// ** import lib` in main.tsx - Change `// ** import lib` to `// ** import core packages` for Hono in upload.ts and delete.ts - Removes `// ** import components` non-standard comment in Dashboard.tsx Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ings
Empty `interface Bindings extends Env {}` is a TypeScript anti-pattern.
Replaced with `type Bindings = Env` which is semantically equivalent
and avoids the no-empty-object-type lint rule.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Owner
Author
Code-review fixes added (3 commits)1.
|
| File | Issue | Fix |
|---|---|---|
apps/web/src/pages/Dashboard.tsx |
Navigate imported but never used |
Removed |
apps/web/src/config/axios.ts |
Three console.error debug calls left in production response interceptor |
Removed all three |
apps/web/src/config/axios.ts |
VITE_API_URL env var mismatched VITE_API_BASE_URL used by auth-client.ts and urls.ts |
Unified to VITE_API_BASE_URL |
apps/web/src/rest-api/storage/delete-file.ts |
catch (error) — error captured but never referenced |
Changed to bare catch |
2. style — import order per AGENT.md
| File | Issue | Fix |
|---|---|---|
apps/web/src/components/auth/ProtectedRoute.tsx |
// ** import lib appeared before // ** import types |
Reordered: types → lib |
apps/web/src/main.tsx |
App and Providers placed under non-standard // ** import utils section |
Moved into // ** import lib |
apps/server/src/routes/storage/upload.ts |
Hono import labelled // ** import lib |
Changed to // ** import core packages (consistent with all other route files) |
apps/server/src/routes/storage/delete.ts |
Same Hono comment inconsistency | Fixed |
3. fix(auth) — TypeScript quality
| File | Issue | Fix |
|---|---|---|
packages/auth/src/types.ts |
interface Bindings extends Env {} — empty interface is a TypeScript anti-pattern and triggers @typescript-eslint/no-empty-object-type |
Replaced with type Bindings = Env |
Type-check status
bun run check-types has two pre-existing failures unrelated to these changes:
@repo/auth:better-authinternal type mismatch (bannedfield) — existed before this PRweb:auth-client.tsTS2742 portable type error — existed before this PR
No new type errors introduced.
…h v1.6 upgrade better-auth v1.6 uses zod v4 internally which produces non-portable type references when inferred across package boundaries (TS2742). Fix: - packages/auth/src/auth.ts: cast betterAuth() return to ReturnType<typeof betterAuth> using 'as unknown as' to satisfy the erased generic at the package boundary - packages/auth/src/client.ts: add explicit BaseClient alias with BetterAuthClientPlugin[] to anchor the exported type without referencing internal zod paths - apps/web/src/lib/auth-client.ts: same pattern for authClient export
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
overridesinpackage.jsonbun overridesblock to rootpackage.jsonto address transitive vulnerabilities that can't be fixed by bumping direct deps aloneSecurity Fixes
hono@hono/node-serverfast-xml-parseraxios/follow-redirectsserovalpath-to-regexppicomatchundicirollup/viteflattedkyselysocket.io-parsersrvxpostcssesbuildminimatchbrace-expansionuuidqsPackage Updates
prettier^3.7.4→^3.8.3,turbo^2.6.3→^2.9.6apps/server:hono^4.11.4→^4.12.16,@t3-oss/env-core^0.13.10→^0.13.11,zod^4.3.5→^4.4.1apps/web:axios^1.13.2→^1.15.2,better-auth^1.4.14→^1.6.9,vite^7.1.7→^7.3.2packages/auth:better-auth^1.4.12→^1.6.9,@react-email/render^2.0.2→^2.0.8packages/db:drizzle-orm^0.38.4→^0.45.2,drizzle-zod^0.7.1→^0.8.3,nanoid^5.1.5→^5.1.9packages/storage:@aws-sdk/client-s3+ presigner ^3.967.0→^3.1039.0,nanoid→^5.1.9packages/email-templates:@react-email/components→^1.0.12,react-email→^5.2.11,react/react-dom→^19.2.5Residual Vulnerabilities (14 remaining)
These are locked-in transitives inside
apps/tanstackworkspace (nitro, @tanstack/react-start, better-auth's internal h3 dep) and tooling deps where upstream packages haven't released compatible patched versions yet:h3>=2.0.0 <=2.0.1-rc.14 — pulled by nitro + @tanstack/react-start (pre-release only available)ajv<6.14.0 — pulled by shadcn + react-email build toolsdefu<=6.1.4 — pulled by better-auth internal@modelcontextprotocol/sdk— pulled by shadcn toolingminimatch>=10.0.0 <10.2.1 — new advisory range on 10.x series (different from the 3.x advisory we fixed)@isaacs/brace-expansion<=5.0.0 — pulled by eslint-config toolingThese are all in dev/build tooling or experimental workspace, none in the production request path.
Test Plan
bun run check-typespasses ✅ (verified before this PR)bun auditshows 14 remaining (down from 82)Summary by Sourcery
Reduce security vulnerabilities across the monorepo by updating dependencies and enforcing secure versions via root overrides.
Bug Fixes:
Enhancements:
Summary by CodeRabbit