Repository navigation
chore(deps): dependency review, security refresh, and resume Dependabot - #732
Open
devknight-ink wants to merge 3 commits into
Open
devknight-ink wants to merge 3 commits into
devknight-ink wants to merge 3 commits into
Conversation
…isories Direct updates (all within the current major unless noted): - next / eslint-config-next 16.4.1 -> 16.4.5 - eslint 9.32.0 -> 10.14.0. ESLint 9 is end-of-life (npm marks 9.39.5 "no longer supported"). create-next-app ships eslint ^10 with the same plugin set, and lint output here is identical (0 errors, 19 warnings). eslint-plugin-import / jsx-a11y / react still declare a ^9 peer, so pnpm prints peer warnings; those are the same ones every new Next 16 app gets. - eslint-plugin-simple-import-sort 12.1.1 -> 14.0.0 (no autofix changes) - typescript 5.8.3 -> 5.9.3 (6.x deprecates baseUrl; left for its own PR) - prettier 3.6.2 -> 3.9.10 (format:js:check still passes unchanged) - cspell 9.2.0 -> 10.4.0 (only breaking change is Node >= 22.18; .nvmrc pins 22.23.4). Pre-existing spellcheck failures are unchanged. - postcss 8.5.6 -> 8.5.32 (4 advisories incl. arbitrary file read) - autoprefixer 10.4.21 -> 10.6.2, remark-mdx 3.1.0 -> 3.1.1 - @types/node 24.1.0 -> 22.20.5 to match the Node 22 runtime pinned in .nvmrc / volta rather than tracking npm latest. Removed unused devDependencies: - mdx@0.3.1 is an unrelated 2015 "documentation extractor", not MDX, and pulled in trim-newlines@1 (high advisory). - eslint-plugin-mdx is not referenced by eslint.config.js. Transitive dependencies were re-resolved within their declared ranges (`pnpm update`), which among other things picks up dompurify 3.4.17 (critical GHSA-cg2g-xh64-v4q7, via nextra > mermaid), @xmldom/xmldom 0.9.12, lodash-es 4.18, browserslist 4.28.7 and the minimatch / brace-expansion / js-yaml / picomatch ReDoS fixes. remark-lint-frontmatter-schema pins exact stale versions of json-schema-ref-parser, ajv, minimatch and yaml; scoped pnpm overrides move them to patched same-major releases. lint:mdx still passes. pnpm audit: 93 advisories (1 critical, 55 high) -> 5 (0 critical, 1 high). Remaining, all build/lint-time and needing an upstream major bump: zod 3 (nextra 3), glob 10 (remark-cli), minimatch 9/10 (eslint stack), katex 0.16 (nextra). zod and katex are resolved by the Nextra 4 migration.
…erage Dependabot's last PR here was 2025-10-27; it auto-paused after 90 days with no one merging, closing or commenting on its PRs (five stale ones are still open). Any change to this file resumes it. - Group minor + patch bumps into one weekly PR so they actually get merged instead of piling up; majors stay as individual PRs. - Keep next/eslint-config-next, react/react-dom/@types, and nextra/nextra-theme-docs in lockstep groups. - Ignore majors that are migrations, not bumps: nextra 4 (App Router), tailwindcss 4 (config/PostCSS plugin), and @types/node (tracks .nvmrc). - 7-day cooldown on version updates as a supply-chain buffer; security updates bypass it. - Add the github-actions ecosystem, including the composite action under .github/actions/, so SHA-pinned actions get bumped with their comments. - versioning-strategy: increase, matching the exact pins in package.json. Dependabot alerts / security updates are a repo setting (currently disabled) that an org admin needs to enable separately.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
cooldown is per package-ecosystem entry; the npm block had it but the github-actions block did not (flagged by SecureSDLC: Dependabot Missing Cooldown).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency review + Dependabot resume. Two commits:
chore(deps)– direct updates, two unused packages removed, transitive deps re-resolved, four scoped overrides.ci– rewrite.github/dependabot.yamlso Dependabot actually runs again and produces mergeable PRs.pnpm auditThe critical one was DOMPurify (
GHSA-cg2g-xh64-v4q7, vianextra > @theguild/remark-mermaid > mermaid); mermaid's range already allowed 3.4.17 so a lockfile refresh picked it up — no override needed. This supersedes #724 and #708.Direct dependency changes
next,eslint-config-nexteslintcreate-next-appshipseslint ^10with the same plugin set. Lint output here is identical (0 errors / 19 warnings, no autofix changes).eslint-plugin-import/jsx-a11y/reactstill declare^9peers, sopnpm installprints the same peer warnings every new Next 16 app gets.eslint-plugin-simple-import-sorttypescriptbaseUrl(whichtsconfig.jsonuses) — left for its own PRprettierformat:js:checkpasses with no reformattingcspell.nvmrcpins 22.23.4. Pre-existing spellcheck failures unchanged (9 vs 10 issues; #726 covers those)postcsssourceMappingURLautoprefixerremark-mdx@types/node.nvmrc/volta instead of npm latest; Dependabot is told to ignore majors for itmdxtrim-newlines@1(high)eslint-plugin-mdxeslint.config.jsDeliberately not bumped:
nextra3 → 4 (App Router migration),tailwindcss3 → 4 (config/PostCSS migration),typescript→ 6/7.Overrides
remark-lint-frontmatter-schema@3.15.4(already latest) pins exact stale versions of@apidevtools/json-schema-ref-parser,ajv,minimatchandyaml. Fourpnpm.overridesscoped to that package move them to patched same-major releases.lint:mdxstill passes.Remaining advisories (accepted)
All lint/build-time only and all need an upstream major bump:
zod@3(high) – Nextra 3 uses the zod 3 API; goes away with Nextra 4glob@10(moderate) –remark-cli > unified-args; fix is glob 14minimatch@9/10(moderate) – ESLint stack; fix is minimatch 11katex@0.16(low) – Nextra; fix is katex 0.18Dependabot
Dependabot's last PR here was 2025-10-27. It auto-paused after 90 days with no merge/close/comment on its PRs (#563, #566, #569, #570, #571 are still open and stale). Merging this change to
dependabot.yamlresumes it; it should then close those five itself.Config changes: minor+patch grouped into one weekly PR (majors stay individual); lockstep groups for next/react/nextra; majors ignored for nextra, tailwindcss and
@types/node(with reasons in comments); 7-day cooldown on version updates (security updates bypass it);github-actionsecosystem added, including the composite action under.github/actions/;versioning-strategy: increaseto match the exact pins. Validated against the SchemaStoredependabot-2.0schema.Verification
pnpm install --frozen-lockfile✅pnpm lint:js– 0 errors, 19 warnings (unchanged) ✅pnpm lint:mdx✅pnpm format:js:check✅tsc --noEmit✅pnpm build(+next-sitemap) ✅