Skip to content

chore: resolve open dependabot security alerts - #2028

Merged
jonathannorris merged 2 commits into
mainfrom
chore/dependabot-alerts
Aug 24, 2026
Merged

chore: resolve open dependabot security alerts#2028
jonathannorris merged 2 commits into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

@jonathannorris jonathannorris commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Dependabot Alerts Resolved

Alert Package Severity Fix
#275 js-yaml high Bumped to 4.3.1 via package.json/package-lock.json
#280 github.com/moby/go-archive high Bumped to v0.3.3 via go get/go mod tidy

Unresolvable (no compatible patched version)

The following alerts affect github.com/docker/docker in test/integration/go.mod, pulled in transitively via testcontainers-go, docker/buildx, and docker/compose/v5. Upstream moved the fixed releases (v29.x+) to a new module path (github.com/moby/moby/v2), so go get github.com/docker/docker@v29.3.1 fails outright (the tagged commit's go.mod declares module github.com/moby/moby/v2, not github.com/docker/docker). There is no compatible tagged version under the old github.com/docker/docker import path, and none of the transitive dependents have migrated to the new module path yet. No safe non-breaking fix is currently available.

Alert Package Severity Status
#152 github.com/docker/docker high No compatible module version available (patched release lives under a different module path, github.com/moby/moby/v2)
#151 github.com/docker/docker medium No patched version reported for the affected code path
#184 github.com/docker/docker high No patched version reported for the affected code path
#185 github.com/docker/docker medium No patched version reported for the affected code path
#186 github.com/docker/docker high No patched version reported for the affected code path

@netlify

netlify Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for polite-licorice-3db33c canceled.

Name Link
🔨 Latest commit d38df6b
🔍 Latest deploy log https://app.netlify.com/projects/polite-licorice-3db33c/deploys/6a8c52936b0d6e0008ffc534

@jonathannorris
jonathannorris marked this pull request as ready for review August 17, 2026 18:47
@jonathannorris
jonathannorris requested review from a team as code owners August 17, 2026 18:47
@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Aug 17, 2026
@coderabbitai

coderabbitai Bot commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31c2999e-8469-416f-9ff1-6be7edb3f6ce

📥 Commits

Reviewing files that changed from the base of the PR and between fd5e02f and d38df6b.

⛔ Files ignored due to path filters (1)
  • test/integration/go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • test/integration/go.mod

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

Walkthrough

The pull request updates the playground application's js-yaml dependency and several indirect dependencies used by integration tests.

Changes

Dependency updates

Layer / File(s) Summary
Update js-yaml constraint
playground-app/package.json		 The runtime dependency constraint changes from ^4.2.0 to ^4.3.1.
Update integration test dependencies
test/integration/go.mod		 Indirect versions for github.com/klauspost/compress and selected Moby modules are updated.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to d38df

This change updates dependency versions to address security alerts without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: toddbaert

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description check ✅ Passed The description clearly explains the dependency updates, resolved security alerts, and unresolved Docker alerts.
Title check ✅ Passed The title accurately summarizes the dependency updates made to resolve Dependabot security alerts.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@toddbaert toddbaert closed this Aug 17, 2026
@toddbaert toddbaert reopened this Aug 17, 2026
@toddbaert

toddbaert commented Aug 17, 2026

Copy link
Copy Markdown
Member

closed/opened to try to fix seemingly stuck checks...

@jonathannorris @toddbaert
chore: resolve open dependabot security alerts
b15633f 
- js-yaml 4.3.0 -> 4.3.1 (high, alert #275) in playground-app

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@toddbaert
toddbaert force-pushed the chore/dependabot-alerts branch from fd5e02f to b15633f Compare August 18, 2026 12:35
@jonathannorris
chore: bump moby/go-archive to v0.3.3 to resolve dependabot alert #280
d38df6b 
- github.com/moby/go-archive v0.2.0 -> v0.3.3 (high, alert #280): crafted tar archive could write outside the extraction directory

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris
jonathannorris marked this pull request as draft August 24, 2026 14:18
@sonarqubecloud

sonarqubecloud Bot commented Aug 24, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@jonathannorris
jonathannorris requested a balanced review from Copilot August 24, 2026 14:18
@jonathannorris
jonathannorris marked this pull request as ready for review August 24, 2026 14:19
@jonathannorris
jonathannorris merged commit 8a0619a into main Aug 24, 2026
15 of 19 checks passed
Copilot AI reviewed Aug 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates vulnerable JavaScript and Go dependencies used by the playground and integration tests.

Changes:

  • Upgrades js-yaml to 4.3.1.
  • Upgrades go-archive to v0.3.3 and related transitive dependencies.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File Description
playground-app/package.json Updates the js-yaml requirement.
playground-app/package-lock.json Locks js-yaml 4.3.1.
test/integration/go.mod Updates vulnerable Go dependencies.
test/integration/go.sum Refreshes checksums for updated modules.
Files not reviewed (1)
  • playground-app/package-lock.json: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@JamieSinn JamieSinn JamieSinn approved these changes
@toddbaert toddbaert toddbaert approved these changes

Assignees

No one assigned

Labels

size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jonathannorris @toddbaert @JamieSinn