fix(security): resolve 209 dependabot advisories across core, dashboard, and packages - #26
Conversation
Updated @vitest/ui and vitest to version 4.1.10 in the onboard package. Added an override for esbuild to version 0.25.0. refactor: enhance alerts controller with ALERT_TYPE Imported ALERT_TYPE in alerts.controller.ts. Updated baseFilter to use ALERT_TYPE for alert_type field. fix: use NOTIFICATION_STATUS_SF in unified consumer and recovery cron Replaced hardcoded 'delivered' status with NOTIFICATION_STATUS_SF.delivered in unified.consumer.ts. Updated recovery.cron.ts to use NOTIFICATION_STATUS_SF for both 'delivered' and 'failed' statuses.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b37fb986e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "typescript": "^5.0.0", | ||
| "vitest": "^2.0.0" | ||
| "typescript": "^5.9.3", | ||
| "vitest": "^4.1.10" |
There was a problem hiding this comment.
With this upgrade, the lockfile resolves vitest to 4.1.10 and its vite dependency to 8.1.5, whose engines.node is ^20.19.0 || >=22.12.0 in packages/create-simplens-plugin/package-lock.json. This package still advertises Node >=22.0.0, so maintainers on Node 22.0–22.11 can satisfy this package's engines but then hit engine-strict install failures or Vite test-runner failures when running npm test; either raise this package's engine floor to >=22.12.0 or keep the test tooling on a Node-22.0-compatible version.
Useful? React with 👍 / 👎.
1 participant
📌 Summary
Remediates all 209 Dependabot security advisories across the core service, dashboard
UI, and CLI packages. Brings npm audit down to 0 vulnerabilities across all 6
manifest scopes without introducing breaking changes or build regressions.
🛠️ Key Changes
• Lockfile Overrides & Security Upgrades:
• Core Root: Overrode @hono/node-server (^2.0.5).
• Dashboard UI: Overrode sharp (^0.35.0), dompurify (^3.2.4), picomatch (^4.0.4),
cross-spawn (^7.0.5), postcss, cookie, d3-color, and flatted. Updated next to
16.2.10.
• MCP Server: Overrode esbuild (0.27.2) and @hono/node-server (^2.0.5).
• CLI Packages (create-simplens-plugin, onboard, config-gen): Upgraded vitest
and @vitest/ui to ^4.1.10, bumped yaml, and added esbuild overrides.
• TypeScript & Mongoose Safety:
• Fixed enum typing in src/api/controllers/alerts.controller.ts,
src/processors/unified/unified.consumer.ts, and src/workers/recovery/recovery.
cron.ts for strict Mongoose compilation.
• Test Mock Adjustments:
• Updated chalk and git mocks in packages/create-simplens-plugin to ensure test
runner compatibility.
🧪 Test Evidence & Verification
• Vulnerability Audits: npm audit reports 0 vulnerabilities across all 6 subprojects.
• Core API: npm run build compiled clean; npm run test:unit passed 238/238 tests.
• Dashboard UI: npx next build compiled production pages cleanly.
• CLI Tools: 56/56 tests passed in create-simplens-plugin; 74/74 tests passed in
onboard.