deps: fix 5 security alerts, incl. a sharp override blocking the patch - #140
Conversation
nodemailer was locked at 9.0.1, which carries four advisories. Bumped the floor to ^9.1.1 (the patched version for all four) and switched the override to the $nodemailer reference so the dependency range and the override can no longer drift apart. sharp was stuck at 0.35.3 because our own root override pinned it to ^0.35.0. next already requires ^0.35.4, so the override was the only thing holding the tree on the vulnerable version. Raised it to ^0.35.4. Alerts closed: #172, #173, #174, #175 (nodemailer), #176 (sharp).
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe pull request updates ChangesDependency version alignment
Priority: ⬆️ High Estimated code review effort: 1 (Trivial) | ~3 minutes Change: Other Merge Risk: ⚪ Minimal · up to The dependency updates are aligned and verified, with no remaining merge-blocking concern. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description gives a detailed summary, change list, security context, and verification results. It does not follow the repository template because it omits the required Type of Change, Database Changes, Security Checklist, Deployment Notes, and Screenshots sections. Resolution Update the description to include every template section. Mark non-applicable items explicitly, select the applicable change and database options, record the test results, complete the security checklist, and state deployment considerations or that none exist.
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Some tools did not complete. Review the errors below. 🔧 ESLint
package.jsonESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Five open Dependabot alerts on
main, all resolved by two version bumps.The sharp one is worth calling out:
nextalready requiressharp: ^0.35.4, but our own rootoverridesentry pinned it to^0.35.0, so the tree sat on the vulnerable 0.35.3. The override was the only thing holding it back.Alert #175 needs
> 9.1.0, so 9.1.1 is the floor that clears all four nodemailer advisories at once.Changes
package.json:nodemailerdependency^9.0.1to^9.1.1nodemaileroverride^9.0.1to$nodemailer, so the range and the override cannot drift apart againsharpoverride^0.35.0to^0.35.4package-lock.json: nodemailer 9.1.1, sharp 0.35.4 and its 17 platform binaries, libvips 1.3.3. No packages added or removed.Verification
vitest run: 1078 passed (49 files)tsc --noEmit: cleannpm run lintfails on this branch, but it fails the same way on pristinemain(TypeError: Converting circular structure to JSONinside ESLint's own config loader,'react' closes the circle). Verified by reverting both files tomain, reinstalling and re-running. Unrelated to this change and left alone.Summary by CodeRabbit