fix(deps): patch 68 security vulnerabilities and update packages#9
Open
jacksonkasi1 wants to merge 3 commits intoorganization-v2from
Open
fix(deps): patch 68 security vulnerabilities and update packages#9jacksonkasi1 wants to merge 3 commits intoorganization-v2from
jacksonkasi1 wants to merge 3 commits intoorganization-v2from
Conversation
Security fixes (bun overrides + direct bumps): - hono -> 4.12.16 (GHSA-r5rp-j6wh-rvv4, GHSA-wmmm-f939-6g9c, GHSA-92pp-h63x-v22m, others) - @aws-sdk/client-s3 + presigner -> 3.1039.0 (pulls fixed fast-xml-parser) - fast-xml-parser override -> ^5.3.4 (GHSA-m7jm-9gc2-mpf2 critical, GHSA-jmr7-xgp7-cmfj, others) - axios -> ^1.15.2 (GHSA-r4q5-vmmm-2653 via follow-redirects) - react/react-dom -> ^19.2.5, react-router-dom -> ^7.14.2 - @react-email/components -> ^1.0.12, react-email -> ^5.2.11 Root overrides for transitive vulns: seroval, path-to-regexp, picomatch, undici, srvx, rollup, flatted, minimatch, brace-expansion, kysely, socket.io-parser, postcss, uuid, qs, esbuild, @hono/node-server, @modelcontextprotocol/sdk, follow-redirects, vite, hono Package updates: - prettier -> ^3.8.3, turbo -> ^2.9.6 (root devDeps) - zod -> ^4.4.1, nanoid -> ^5.1.9, drizzle-orm -> ^0.45.2 - @t3-oss/env-core -> ^0.13.11, @react-email/render -> ^2.0.8 - onboarding zod -> ^4.4.1, email-templates bumped to latest
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideMonorepo-wide dependency refresh focused on resolving security advisories by adding a centralized overrides block at the root, bumping vulnerable and adjacent packages across apps and packages, updating the Bun lockfile, and introducing an audit baseline to track the remaining non-prod vulnerabilities. Flow diagram for bun audit using the new audit baselineflowchart LR
A["Developer runs bun audit"] --> B["bun audit scans dependencies
using bun_lock and overrides"]
B --> C["bun audit outputs current vulnerabilities list"]
C --> D{"Audit baseline present? (.audit-baseline_txt)"}
D -- Yes --> E["Load baseline vulnerabilities
(14 known non-prod issues)"]
E --> F["Compare current vulnerabilities
against baseline"]
F --> G{"New or regressed vulnerabilities?"}
G -- No --> H["Exit 0
(acceptable risk level)"]
G -- Yes --> I["Exit with failure
block merge or deployment"]
D -- No --> J["Treat all vulnerabilities as new"]
J --> I
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- The root
overridesblock centralizes a lot of major-version forcing (e.g.,ajv,minimatch,h3rc,esbuild); consider constraining these to the minimal compatible versions and/or only where needed to reduce the risk of subtle breakage in tools that still expect older major ranges. - Given that security fixes are now encoded in
overrides, it may be helpful to group or annotate them (e.g., by ecosystem or vulnerability driver) so future dependency updates can more easily determine which overrides are still necessary and which can be removed.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The root `overrides` block centralizes a lot of major-version forcing (e.g., `ajv`, `minimatch`, `h3` rc, `esbuild`); consider constraining these to the minimal compatible versions and/or only where needed to reduce the risk of subtle breakage in tools that still expect older major ranges.
- Given that security fixes are now encoded in `overrides`, it may be helpful to group or annotate them (e.g., by ecosystem or vulnerability driver) so future dependency updates can more easily determine which overrides are still necessary and which can be removed.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Fix minimatch override ^10.0.3 -> ^10.2.1 (was still in advisory range). Add ajv -> ^8.18.0 override. Remaining 6 all from h3 >=2.0.0 <=2.0.1-rc.14 (nitro / @tanstack/react-start); no stable patched release upstream.
…console noise - Add `debug` level to @repo/logs logger - Demote four verbose logger.info calls inside hooks.after /get-session middleware to logger.debug — fires on every session check and was spamming production logs - Merge duplicate @repo/db imports in packages/auth/src/auth.ts into one - Remove redundant console.error calls from axios response interceptors in web and tanstack apps (error already re-thrown to callers) - Remove console.error from onboarding catch blocks in web and tanstack (user-facing toast already surfaces the error message) - Remove unused sharedUtility export from packages/config/src/index.ts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Owner
Author
Code review fixes —
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
overridesinpackage.jsonbun overridesblock to rootpackage.jsonSecurity Fixes
hono@hono/node-serverfast-xml-parseraxios/follow-redirectsserovalpath-to-regexppicomatchundicirollup/viteflattedkysely@modelcontextprotocol/sdksocket.io-parsersrvxesbuildminimatchbrace-expansionuuidqspostcssPackage Updates
prettier^3.7.4→^3.8.3,turbo^2.6.3→^2.9.6apps/server:hono→^4.12.16,@t3-oss/env-core→^0.13.11,zod→^4.4.1,prettier→^3.8.3apps/tanstack:axios^1.13.2→^1.15.2apps/web:axios→^1.15.2,react/react-dom→^19.2.5,react-router-dom→^7.14.2,prettier→^3.8.3packages/auth:@react-email/render→^2.0.8,zod→^4.4.1packages/db:drizzle-orm→^0.45.2,drizzle-zod→^0.8.3,nanoid→^5.1.9packages/storage:@aws-sdk/client-s3+ presigner →^3.1039.0,nanoid→^5.1.9packages/email-templates:@react-email/components→^1.0.12,@react-email/tailwind→^2.0.7,react-email→^5.2.11,react/react-dom→^19.2.5packages/onboarding:zod→^4.4.1Residual Vulnerabilities (14 remaining)
Locked-in transitives in
apps/tanstack/nitro/better-authecosystem where upstream hasn't released compatible patched versions:h3>=2.0.0 <=2.0.1-rc.14 (nitro + @tanstack/react-start)ajv<6.14.0 (shadcn + react-email build tools)defu<=6.1.4 (better-auth internal)minimatch>=10.0.0 <10.2.1 (new 10.x advisory range)@isaacs/brace-expansion<=5.0.0 (eslint-config tooling)All in dev/build tooling, none in the production request path.
Test Plan
bun run check-typespasses ✅ (verified before this PR)bun auditshows 14 remaining (down from 82)Summary by Sourcery
Reduce security vulnerabilities across the monorepo by upgrading dependencies and enforcing patched versions via root overrides.
Bug Fixes:
Enhancements: