chore: resolve Dependabot alerts in transitive dependencies (#DS-5215) - #212
Merged
Conversation
Pin six vulnerable transitive dependencies through the existing `resolutions` block. All six are pulled in by tooling — none is declared directly in `dependencies`/`devDependencies`: - tar 6.2.1 -> 7.5.22 (cacache, node-gyp, pacote) — 8 alerts - serialize-javascript 6.0.2 -> 7.1.0 (copy-webpack-plugin, css-minimizer-webpack-plugin) — 2 alerts - tmp 0.0.33 -> 0.2.7 (external-editor) — 2 alerts - dompurify 3.4.12 -> 3.4.13 (jspdf) — 1 alert - adm-zip 0.5.18 -> 0.6.0 (@module-federation/dts-plugin) — 1 alert - uuid 8.3.2 -> 11.1.1 (sockjs) — 1 alert tar@7.5.22 and tmp@0.2.7 were already in the tree via other parents, so the overrides collapse duplicates instead of adding copies — hence the net removal of chownr, fs-minipass, minipass@5, mkdirp, os-tmpdir and randombytes from the lockfile. uuid is pinned to 11.1.1, the minimum patched version, rather than the latest 14.x: sockjs@0.3.24 was written against uuid 8 and only calls `v4()`, so the smaller jump keeps the risk down. serialize-javascript uses the unranged key form while the rest of the block is descriptor-scoped. Three parents declare three different ranges (^6.0.0, ^6.0.1, ^6.0.2), which the descriptor form would need three keys to cover. The unranged form is safe here specifically because nothing in the tree asks for serialize-javascript above 6 — an unranged key applies tree-wide and pins downwards, so it is not a good default elsewhere. Both forms resolve to a byte-identical lockfile. The remaining Dependabot alerts (Angular, vite, sigstore, esbuild, nx) cannot be fixed this way while the repository stays on Angular 18 and Nx 20 — those toolchains pin the affected versions themselves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChangesDependency resolution
Estimated code review effort: 1 (Trivial) | ~2 minutes Mergeability Score: ⚪ Minimal · up to This localized dependency update has no actionable merge-blocking risk remaining after the normal build and unit checks pass. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Pull request overview
Pins several vulnerable transitive dependencies via Yarn resolutions in this Nx/Yarn 4 workspace, updating the lockfile accordingly to address Dependabot alerts without changing direct dependencies.
Changes:
- Added/updated Yarn
resolutionsentries foradm-zip,dompurify,serialize-javascript,tar,tmp, anduuid. - Regenerated
yarn.lockto reflect the overrides and remove now-unneeded duplicate transitive packages.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Adds resolutions pins for the six vulnerable transitive dependencies described in the PR. |
| yarn.lock | Updates resolved versions to match the new overrides and collapses duplicate transitive entries. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
artembelik
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin six vulnerable transitive dependencies through the existing
resolutionsblock. All six are pulled in by tooling — none is declared directly independencies/devDependencies:tar@7.5.22 and tmp@0.2.7 were already in the tree via other parents, so the overrides collapse duplicates instead of adding copies — hence the net removal of chownr, fs-minipass, minipass@5, mkdirp, os-tmpdir and randombytes from the lockfile.
uuid is pinned to 11.1.1, the minimum patched version, rather than the latest 14.x: sockjs@0.3.24 was written against uuid 8 and only calls
v4(), so the smaller jump keeps the risk down.serialize-javascript uses the unranged key form while the rest of the block is descriptor-scoped. Three parents declare three different ranges (^6.0.0, ^6.0.1, ^6.0.2), which the descriptor form would need three keys to cover. The unranged form is safe here specifically because nothing in the tree asks for serialize-javascript above 6 — an unranged key applies tree-wide and pins downwards, so it is not a good default elsewhere. Both forms resolve to a byte-identical lockfile.
The remaining Dependabot alerts (Angular, vite, sigstore, esbuild, nx) cannot be fixed this way while the repository stays on Angular 18 and Nx 20 — those toolchains pin the affected versions themselves.
Summary by CodeRabbit