Skip to content

Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities) - #1148

Merged
alexmontesg merged 3 commits into
mainfrom
bugfix/GH-1147-upgrade-vulnerable-direct-dep
Sep 2, 2026
Merged

Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)#1148
alexmontesg merged 3 commits into
mainfrom
bugfix/GH-1147-upgrade-vulnerable-direct-dep

Conversation

@alexmontesg

@alexmontesg alexmontesg commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Closes #1147

@alexmontesg
alexmontesg force-pushed the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch 4 times, most recently from e391a3f to 861d27a Compare September 1, 2026 08:08
@alexmontesg
alexmontesg marked this pull request as ready for review September 1, 2026 08:11
@alexmontesg
alexmontesg force-pushed the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch from 861d27a to a072413 Compare September 1, 2026 08:15
@alexmontesg
alexmontesg requested a review from jesusmpc September 1, 2026 08:15
@alexmontesg alexmontesg self-assigned this Sep 1, 2026
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-01

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

@alexmontesg
alexmontesg force-pushed the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch from a072413 to 35bcd77 Compare September 1, 2026 15:35
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-01

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

jesusmpc
jesusmpc requested changes Sep 2, 2026
View reviewed changes
Comment thread code/package.json Outdated
Comment thread code/packages/store-websockets/package.json Outdated
alexmontesg added a commit that referenced this pull request Sep 2, 2026
@alexmontesg
fix(deps): pin tsdown exactly and drop redundant root ws override
db0353c 
Address review feedback on #1148:
- Pin tsdown to an exact version (0.22.14, no caret range) in all 10
  packages that declare it, matching the exact-pin convention already
  used for the other vulnerability-fix bumps (ws, @azure/identity,
  @nx/js, nx).
- Remove the root package.json `ws` override — it was added to force
  jsdom's transitive ws resolution to dedupe onto the patched version,
  but a fresh `npm install` now naturally dedupes jsdom's ws range
  onto the 8.21.3 pinned directly by store-websockets/
  store-azure-web-pubsub without needing a root-level override.

npm audit still reports 0 vulnerabilities; full build/lint/test suite
passes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-02

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

1 similar comment
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-02

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

@alexmontesg
alexmontesg force-pushed the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch from 0559774 to ca6f528 Compare September 2, 2026 07:11
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-02

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

@alexmontesg
alexmontesg force-pushed the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch 2 times, most recently from aa8718f to 1cfc9a4 Compare September 2, 2026 13:39
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

❌ No changes in the CHANGELOG.md file

No changes were found in the CHANGELOG.md file. Please, update the UNRELEASED section, listing the new changes that applies to this release.

@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-02

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

alexmontesg and others added 3 commits September 2, 2026 15:51
@alexmontesg
fix(deps): upgrade vulnerable direct dependencies to clear npm audit
7d077ac 
Bump @azure/identity (4.10.2->4.13.2), @nx/js+nx (22.x->23.1.2, major
rescoped mid-implementation as the advisory range expanded), tsdown
(0.10.2->0.22.14, major), and ws (8.18.1->8.21.3), plus root overrides
for ws/axios/fast-uri drift.

Fixes 3 regressions surfaced by the bumps:
- add explicit tsdown devDependency to store-standalone,
  store-websockets, create-frontend-app (previously relied on hoisting)
- use namespace import for express-serve-static-core in
  store-azure-web-pubsub (rolldown-plugin-dts rejects synthetic default)
- set fixedExtension: false in all platform:'node' tsdown configs to
  preserve .js/.d.ts output matching package.json exports maps

npm audit now reports 0 vulnerabilities. Full build/lint/test suite
passes. Manually verified multi-tab collaboration sync, Azure Web
PubSub auth, and blob storage auth against a live Azure instance via
Playwright.

Closes #1147

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@alexmontesg
fix(store-azure-web-pubsub): mark hub constructor param as readonly
525ebd9 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@alexmontesg
docs(changelog): document dependency bump
a5e4a71
@alexmontesg
alexmontesg force-pushed the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch from 3d74fa5 to a5e4a71 Compare September 2, 2026 13:51
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🚀 Release Preview Success

You are going to release the version patch with the following changes:

5.2.2 - 2026-09-02

Fixed

  • #1147 Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

💡 Merge Strategy: Squash and Merge

Remember to use the 'Squash and Merge' strategy to merge this Pull Request (bugfix/GH-1147-upgrade-vulnerable-direct-dep → main).

@sonarqubecloud

sonarqubecloud Bot commented Sep 2, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@alexmontesg
alexmontesg merged commit 5223646 into main Sep 2, 2026
20 checks passed
@alexmontesg
alexmontesg deleted the bugfix/GH-1147-upgrade-vulnerable-direct-dep branch September 2, 2026 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jesusmpc jesusmpc jesusmpc approved these changes

Assignees

@alexmontesg alexmontesg

Labels

release-type/patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Upgrade vulnerable direct dependencies (npm audit: 0 vulnerabilities)

2 participants

@alexmontesg @jesusmpc