chore: resolve open dependabot security alerts - #1222
Merged
Conversation
- js-yaml 3.14.1 -> 3.15.0 (medium, alerts #1175, #1176) - js-yaml 4.1.0 -> 4.3.0 (medium, alerts #1171, #1172, #1173, #1174) - webpack-dev-server -> 5.2.5 (medium, alerts #1167, #1168, #1169) - http-proxy-middleware 2.0.9 -> 2.0.10 (medium, alerts #1164, #1165, #1166) - @babel/core -> 7.29.7 (low, alerts #1139, #1140, #1163) - undici -> 6.27.0 (low/medium/high, alerts #1154-#1161) - tar -> 7.5.16 (medium, alerts #1149-#1152) - ws 6.x -> 6.2.4, ws 7.x -> 7.5.11, ws 8.x -> 8.21.0 (high, alerts #1141, #1142, #1145) - form-data 4.0.5 -> 4.0.6 (high, alerts #1143, #1144) - protobufjs -> 7.6.4 (high/medium, alerts #1135, #1136) - protobufjs-cli 1.2.2 -> 1.3.3 (high, alert #1132) - launch-editor -> 2.14.1 (medium, alerts #1134, #1137, #1138) - markdown-it 12.3.2 -> 14.3.0 (medium, alert #1133) - joi 17.6.0 -> 17.13.4 (medium, alert #1125)
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
jonathannorris
enabled auto-merge (squash)
July 2, 2026 13:44
Contributor
There was a problem hiding this comment.
Pull request overview
Resolves multiple Dependabot security alerts by upgrading vulnerable transitive dependencies using Yarn lockfile updates plus resolutions/dependency bumps across the monorepo and e2e fixtures.
Changes:
- Updated root dependency versions and added/expanded
resolutionsoverrides for vulnerable packages (e.g.,ws,form-data,undici,tar,js-yaml,markdown-it,joi). - Bumped select direct deps/devDeps (
@babel/core,protobufjs,protobufjs-cli) to pull in patched versions. - Updated e2e package-level
resolutionsand devDependencies to keep test apps aligned with the patched dependency graph.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| yarn.lock | Locks upgraded (patched) versions for multiple vulnerable transitive dependencies. |
| package.json | Updates direct deps/devDeps and adds resolutions to force patched versions repo-wide. |
| e2e/react/package.json | Updates devDependency/resolutions to keep React e2e app aligned with patched versions. |
| e2e/js/js-esm/package.json | Updates resolutions to keep JS ESM e2e app aligned with patched versions. |
| e2e/js/js-cloud-server/package.json | Updates resolutions to keep cloud-server e2e app aligned with patched versions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- js-yaml@^4.1.0 and js-yaml@4.1.0 resolutions: ^4.2.0 -> ^4.3.0 - markdown-it@^12.3.2 resolution: ^14.2.0 -> ^14.3.0 - protobufjs: ^7.6.3 -> ^7.6.4 (dep + resolution) - protobufjs-cli: ^1.3.2 -> ^1.3.3 (devDep + resolution) - @babel/core devDep: ^7.29.6 -> ^7.29.7 - @babel/core resolutions in e2e packages: ^7.29.6 -> ^7.29.7 - js-yaml v4 resolutions in e2e packages: ^4.2.0 -> ^4.3.0 Aligns declared ranges with actual locked versions to prevent re-introducing vulnerable versions on lockfile regeneration.
Use rm -f to remove sed backup files so the command succeeds even if no backup files were created (e.g., Alpine/BusyBox sed treats -i.bu as in-place edit without creating a backup file).
This reverts commit 398d500.
canvas@3.1.0 fails to compile from source on Alpine 3.24 ARM64 due to missing librsvg-dev in the test-harness Docker image. Since canvas is only used for Detox visual testing (not the nodejs SDK build), mark it as built:false in dependenciesMeta to prevent the failed compile from causing yarn to exit non-zero.
JamieSinn
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolved 37 open Dependabot security alerts by bumping vulnerable dependencies via yarn resolutions/overrides.
Dependabot Alerts Resolved
joiprotobufjs-climarkdown-itlaunch-editorprotobufjs@babel/corewsform-datatarundicihttp-proxy-middlewarewebpack-dev-serverjs-yaml(v4)js-yaml(v3)