Repository navigation
fix(deps): clear all advisories — 6 to 0 - #9
Conversation
- sharp ^0.35.3, libvips CVEs GHSA-f88m-g3jw-g9cj - postcss ^8.5.10 as a direct devDependency (npm rejects overriding a declared direct dependency, EOVERRIDE), GHSA-qx2v-qp2m-jg93 - esbuild >=0.28.1, arbitrary file read, reached via tsx - @hono/node-server >=2.0.5, path traversal in the Node adapter - brace-expansion pinned per major range Three things were deliberately not done, each because the obvious move was worse than the problem: npm proposed `@modelcontextprotocol/sdk@1.24.3` as the fix for the hono advisory — a downgrade from the 1.29.0 the MCP server is built on. The hono version was raised directly instead. brace-expansion could not be pinned to a single range. Its advisories cover <=1.1.15, 2.0.0-2.1.1 and >=3.0.0 <5.0.7, so a flat `>=5.0.7` forced 5.x onto minimatch@3, whose CJS `expand` export it dropped — that crashed ESLint outright with "expand is not a function". Now pinned per major: <2 -> ^1.1.16, 2.x -> ^2.1.2, >=3 -> >=5.0.7. eslint-plugin-react-hooks pinned to 7.0.1, the version main resolves. Caret drift during reinstall pulled 7.1.1, whose new `set-state-in-effect` rule flags two pre-existing shadcn patterns (src/hooks/use-mobile.ts and src/components/ui/carousel.tsx). Rewriting React effects inside a security patch is the wrong place for that risk, so the lint surface is held identical to main. Follow-up: unpin eslint-plugin-react-hooks and fix both effects properly, most likely with useSyncExternalStore. Verified: npm audit 0 vulnerabilities, eslint 0 errors, next build succeeds, docs-mcp smoke test passes (3 tools, 38 resources, search ok, read ok).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 10 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch was successfully deployed
1 participant
declared direct dependency, EOVERRIDE), GHSA-qx2v-qp2m-jg93
Three things were deliberately not done, each because the obvious move was
worse than the problem:
npm proposed
@modelcontextprotocol/sdk@1.24.3as the fix for the honoadvisory — a downgrade from the 1.29.0 the MCP server is built on. The hono
version was raised directly instead.
brace-expansion could not be pinned to a single range. Its advisories cover
<=1.1.15, 2.0.0-2.1.1 and >=3.0.0 <5.0.7, so a flat
>=5.0.7forced 5.x ontominimatch@3, whose CJS
expandexport it dropped — that crashed ESLintoutright with "expand is not a function". Now pinned per major:
<2 -> ^1.1.16, 2.x -> ^2.1.2, >=3 -> >=5.0.7.
eslint-plugin-react-hooks pinned to 7.0.1, the version main resolves. Caret
drift during reinstall pulled 7.1.1, whose new
set-state-in-effectruleflags two pre-existing shadcn patterns (src/hooks/use-mobile.ts and
src/components/ui/carousel.tsx). Rewriting React effects inside a security
patch is the wrong place for that risk, so the lint surface is held identical
to main.
Follow-up: unpin eslint-plugin-react-hooks and fix both effects properly,
most likely with useSyncExternalStore.
Verified: npm audit 0 vulnerabilities, eslint 0 errors, next build succeeds,
docs-mcp smoke test passes (3 tools, 38 resources, search ok, read ok).