fix(deps): resolve HIGH severity npm vulnerabilities in website - #3
Conversation
- path-to-regexp: 0.1.12 → 0.1.13 (CVE-2026-4867, GHSA-37ch-88jc-xwx2) - picomatch: 2.3.1 → 2.3.2 (CVE-2026-33671, GHSA-c2c7-rcm5-vvqj) - undici: 7.23.0 → 7.27.1 (CVE-2026-1526/CVE-2026-2229/CVE-2026-1528) - serialize-javascript: 6.0.2 → 7.0.3 (GHSA-5c6j-r48x-rmvq, via overrides) Fixes Dependabot alerts #37, #34, #33, #32, #29, #27
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 71877343ac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ] | ||
| }, | ||
| "overrides": { | ||
| "serialize-javascript": "7.0.3" |
There was a problem hiding this comment.
When this security update is evaluated against current advisories, this override still pins every transitive serialize-javascript consumer to 7.0.3, but the active high-severity advisory covers versions <7.0.5. That means npm audit/Snyk-style checks will continue to flag the website lockfile and the dependency update does not actually resolve the reported vulnerability; pin the override and lockfile to 7.0.5 or newer instead.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in main before PR #25 was merged: serialize-javascript override was bumped to >=7.0.5 and all @docusaurus/* packages were aligned to 3.10.1, so npm audit no longer flags the HIGH CVE and the Mermaid theme runs the same major version as the rest of the Docusaurus stack.
Reviewed and confirmed by Claude Code.
Generated by Claude Code
| "prism-react-renderer": "^2.3.0", | ||
| "react": "^19.0.0", | ||
| "react-dom": "^19.0.0" | ||
| "@docusaurus/theme-mermaid": "^3.10.1", |
There was a problem hiding this comment.
This bumps only @docusaurus/theme-mermaid to 3.10.1 while @docusaurus/core, @docusaurus/preset-classic, and the Docusaurus dev packages remain pinned to 3.9.2. Because website/docusaurus.config.ts enables this theme, the 3.9.2 CLI will load a 3.10.1 official theme and the lockfile now contains a second 3.10.1 Docusaurus stack under the theme; Docusaurus expects all @docusaurus/* packages in a site to use the same version, so Mermaid docs builds can fail on minor-version API mismatches. Either upgrade the whole Docusaurus set to 3.10.1 or keep the theme at 3.9.2.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in main before PR #25 was merged: all @docusaurus/* packages (core, preset-classic, theme-mermaid, and dev deps) were aligned to 3.10.1, removing the mixed-version stack.
Reviewed and confirmed by Claude Code.
Generated by Claude Code
…(Codex PR #6, #10) (#25) Addresses chatgpt-codex-connector review comments on merged PRs #6 and #10. tools/lazy_deps.py (PR #6 — lazy install pins stale after Dependabot audit): - platform.slack: aiohttp 3.13.4 -> 3.14.1 (match [slack] extra) - platform.discord: add aiohttp==3.14.1 (discord.py uses aiohttp transitively; without the pin, a first-use lazy install can leave an older vulnerable aiohttp while `hermes update` considers the feature satisfied) - terminal.modal / terminal.vercel: add cbor2==6.1.2 (both backends pull cbor2 transitively; pin the audited version so existing installs refresh the vulnerable transitive package) - tool.dashboard: add starlette==1.3.1 (FastAPI pulls starlette transitively; same rationale as above) plugins/platforms/discord/adapter.py (PR #10 — voice extra no longer ships PyNaCl): - join_voice_channel now checks for PyNaCl availability before calling channel.connect(). The `voice` extra was intentionally stripped of PyNaCl (it pinned a vulnerable version and triggered Dependabot), but /voice join was still registered and would crash at runtime with an opaque missing-module error. The guard fails fast with a logged warning instructing the user to install PyNaCl>=1.6.2 manually. tests/gateway/test_discord_race_polish.py: - Added test_join_voice_returns_false_when_pynacl_missing (verifies the guard fires before channel.connect()) - Added test_join_voice_proceeds_when_pynacl_available (pins the happy path so the guard is confirmed as the regression boundary) - Updated test_concurrent_joins_do_not_double_connect to mock nacl via patch.dict (prevents sys.modules leakage into other test files) PR #3 website comments already fixed in main: serialize-javascript override is at 7.0.5, all @docusaurus/* packages aligned at 3.10.1. Verification: pytest tests/gateway/test_discord_race_polish.py tests/tools/test_lazy_deps.py tests/test_package_json_lazy_deps.py tests/tools/test_discord_tool.py (157 passed, 2 pre-existing warnings).
… — Codex PR #30 review (#31) Two chatgpt-codex-connector[bot] review comments on PR #30 that still applied to current main (the other 13 were already addressed in the merged PR): 1. client.py #13 — Cancel timed-out MCP calls: _run_sync now cancels the concurrent.futures.Future on timeout before re-raising, so a stalled MCP endpoint doesn't leave a pending HTTP session running on the shared background loop after the caller has given up / opened the breaker. 2. __init__.py #15 — Parse the host before allowing keyless local mode: is_available() now urlparse's the URL and requires an exact loopback host (localhost/127.0.0.1/::1) instead of a substring match, so a URL like 'https://localhost@example.com/mcp' (host=example.com) is no longer trusted as local keyless mode. Adds regression tests: test_memgw_client_timeout.py (cancel-on-timeout fails against pre-fix client) + TestKeylessLocalModeHostParsing (3/4 fail pre-fix). Deferred (already fixed in merged PR #30): MCP dep import check, MCP dep pin, loop lock, isError handling, stale-prefetch generation, sync/delegation thread tracking + shutdown join, session-switch prefetch invalidation, no join on turn path, default provider unset. Deferred (complex, needs interface change): #3/#4 per-turn user_id refresh for shared gateway sessions — sync_turn/prefetch only receive session_id, not user_id, so threading identity through requires a MemoryProvider interface change; #1 in-tree placement is an architectural call (AGENTS.md says existing in-tree providers stay).
1 participant
Summary
Fixes HIGH severity Dependabot alerts in the Docusaurus website (
website/).Changes
serialize-javascriptrequired anoverridesentry since 6.x → 7.x is a major version bump not covered by semver ranges.