fix: resolve 6 critical Dependabot alerts - #5351
Merged
Merged
Conversation
- tar >=7.5.19 (GHSA-23hp-3jrh-7fpw): decompression DoS, pinned via pnpm override within 7.x (transitive via @mapbox/node-pre-gyp) - protobufjs >=7.5.5 (GHSA-xq3m-2v4x-88gg): arbitrary code execution, pinned via pnpm override within 7.x (transitive via @grpc/proto-loader, @opentelemetry/otlp-transformer) - shell-quote ^1.8.4 (GHSA-w7jw-789q-3m8p): quote() didn't escape newlines in object .op values (direct dep, used for docker/ssh command building) - vitest ^4.1.0 (GHSA-5xrq-8626-4rwp): arbitrary file read/execute via UI server (devDependency) - github.com/gofiber/fiber/v2 v2.52.11 (GHSA-68rr-p4fp-j59v): insecure UUIDv4 fallback on crypto/rand failure (apps/monitoring) - next (GHSA-f82v-jwr5-mffw): authorization bypass in middleware, was a transitive dep of react-email in the standalone packages/server/src/emails lockfile; regenerating against the current react-email version (6.9.3) drops next.js entirely, since it no longer uses it for the preview server Verified: typecheck (server + app) clean, full vitest suite (947 passed / 5 env-conditional skips, 0 failures), go build/vet/test clean for apps/monitoring.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the 6 open critical severity alerts on Dependabot → Security:
tar(transitive via@mapbox/node-pre-gyp)>=7.5.19 <8.0.0— decompression DoSprotobufjs(transitive via@grpc/proto-loader,@opentelemetry/otlp-transformer)>=7.5.5 <8.0.0— arbitrary code executionshell-quote(direct dep, used for docker/ssh command building)^1.8.4—quote()didn't.opvaluesvitest(devDependency)^4.1.0— arbitrary file read/execute via UI serverhub.lumenfield.work/gofiber/fiber/v2(apps/monitoring)v2.52.11— insecure UUIDv4 fallback oncrypto/randfailurenext(transitive viareact-email, standalone lockfile inpackages/server/src/emails)react-email(6.9.3), which dropsnextentirely — no longer used for the preview serverVerification
pnpm typecheckclean (server + app)vitestsuite: 947 passed / 5 env-conditional skips, 0 failuresgo build/go vet/go testclean forapps/monitoringOnce merged, these should clear from the dependabots alerts
Ran all the tests but also randomly access pages and api calls to make sure they are working as expected. No issues found
Please describe in a short paragraph what this PR is about.
Checklist
Before submitting this PR, please make sure that:
canarybranch.Issues related (if applicable)
Screenshots (if applicable)
Greptile Summary
This PR updates vulnerable JavaScript and Go dependencies, adds pnpm overrides for vulnerable transitive versions of
tarandprotobufjs, and regenerates the standalone React Email lockfile so that it no longer includes Next.js.shell-quote, Vitest, and Fiber to patched releases.tarandprotobufjsresolutions to patched 7.x versions.Confidence Score: 5/5
The PR appears safe to merge, with no actionable correctness, security, or compatibility failures identified.
The patched dependencies resolve consistently in the lockfiles, satisfy the repository’s declared runtime toolchains, and remain deterministic under frozen-lockfile CI and production installs.
Reviews (1): Last reviewed commit: "fix: resolve 6 critical Dependabot alert..." | Re-trigger Greptile