chore: patch the vitest, postcss, sharp and Next.js advisories - #10
Conversation
npm audit reported eight advisories on main, one of them critical: with the Vitest UI server listening, an arbitrary file could be read and executed. Vitest 2.1.9 also dragged in vulnerable copies of vite and esbuild, and Next.js pinned postcss and sharp inside their vulnerable ranges. Vitest moves to 4.x, which is where the other courses in this series already are, together with the plugin and jsdom versions that release expects. postcss and sharp are lifted by overrides rather than by taking the Next.js 16 major that `npm audit fix --force` proposed, and Next.js moves to the patched 15.5.25. The lockfile is regenerated because npm could not resolve the new peer graph incrementally. vitest.config.ts becomes vitest.config.mts so Vite's native config loader reads it as the ESM it already is; on the old name Vitest 4 warned about it on every run. npm audit now reports zero vulnerabilities. Typecheck, all 54 unit tests and all 4 Playwright specs pass unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
🟢 Approval recommended
The changes are limited to dependency/tooling updates with configuration aligned to the new versions and CI Node 22, and the PR reports full typecheck/test/build verification.
Pull request overview
Updates the project’s JavaScript tooling dependencies to address npm audit security advisories, and adjusts Vitest configuration so the upgraded toolchain loads the test config as native ESM.
Changes:
- Upgraded Next.js and the Vitest/Vite toolchain (Vitest 4,
@vitejs/plugin-react,jsdom) to patched versions. - Added npm
overridesto force patchedpostcssandsharpversions without jumping to Next.js 16. - Regenerated
package-lock.jsonto reflect the updated dependency graph.
File summaries
| File | Description |
|---|---|
| vitest.config.mts | Adds an ESM-native Vitest config with React plugin + @ alias and unit-test scoping. |
| package.json | Bumps Next.js / Vitest toolchain versions and introduces overrides for postcss and sharp. |
| package-lock.json | Lockfile regeneration reflecting the new dependency tree and overridden versions. |
Review details
- Files reviewed: 1/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
What
npm auditreported 8 advisories onmain, one of them critical:2.1.9server.fs.denybypass on Windows alternate paths8.4.31sourceMappingURL0.34.5.mappath traversalHow
@vitejs/plugin-reactandjsdomversions that release expects. This is where AlgoAlgo and TSer already are, so the series stays consistent. It clears the critical plus the vite/esbuild chain.overrides. Every Next.js 15.x pins them inside the vulnerable range, sonpm audit fix --forcewantednext@16.3.4. Overrides lift just those two; Next.js moves to the patched15.5.25.ERESOLVEon the stale@vitejs/plugin-react@4/vite@8pair).vitest.config.ts→vitest.config.mtsso Vite's native config loader reads it as the ESM it already is. On the old name, Vitest 4 printed a config-loader warning on every run.Verification
npm audit— 0 vulnerabilities (was 1 critical, 4 high, 3 moderate)npm run typecheck— cleannpm test— 54/54 passing, warning gonenpm run test:e2e— 4/4 Playwright specs passingnpm run build— passingNo application source changed; this is dependency and test-config only.
🤖 Generated with Claude Code