chore(deps): sweep in-range dependency drift for August 2026 - #714
Merged
Conversation
Dependabot has five open high alerts, all npm transitives reached only through package-lock.json. Three have a published patch and are fixed here with the overrides block the repo already uses for exactly this (brace-expansion@1, and js-yaml@4 which this raises rather than adds). js-yaml@4 4.3.0 -> 4.3.1 GHSA-5p4m-2wfm-xmqj (eslintrc, xcpretty, orval) js-yaml@3 3.15.0 -> 3.15.1 GHSA-5p4m-2wfm-xmqj (@lhci/utils, dev) nanoid@3 3.3.16 -> 3.3.17 GHSA-2v37-7h3g-55p8 (expo-router, postcss) Every dependent's declared range already admits the patched version, so no dependent needed relaxing. npm reported the installed copies "invalid" against the new overrides but would not re-resolve them from the existing lock, so the lockfile was regenerated with `npm update js-yaml nanoid`. The remaining two alerts are image-size (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) and are NOT fixed, because no fixed release exists: the advisory range is <= 2.0.2 and 2.0.2 is the latest published version. npm's only proposed remedy is a major downgrade to expo 53 / react-native 0.72, which is a worse outcome than the bug. It is unreachable in production regardless: image-size is pulled by metro and runs in the bundler at build time, never shipped into the app. Validation: type-check 3/3, and 670 test files pass across all four workspaces. The full suite must be run with --concurrency=1; at turbo's default concurrency the shared barrel-import test at types.test.ts:1943 exceeds its 15s timeout purely from machine contention, unrelated to this change (shared imports neither package). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Monthly non-security freshness sweep. /dep-sweep and the reminder workflow that files these tickets were both deleted by #676, so this follows the contract stated in the ticket body instead: bump web and shared minor/patch, defer mobile to expo install --check, report the orbit-api NuGet drift without changing it. package-lock.json only. Every bump was already inside an existing semver range, so no package.json edit was needed. 263 packages moved, including next 16.2.11 -> 16.3.0, @sentry/* 10.68.0 -> 10.70.0, @supabase/supabase-js 2.110.8 -> 2.112.3, react-hook-form 7.82 -> 7.85, next-intl 4.13.4 -> 4.13.6, axios 1.18.1 -> 1.19.0, and 23 @radix-ui patch bumps. #599 recorded that regenerating this lockfile refloats transitives, so the pins that had to hold were checked against the base commit rather than by eye. Every exactly-pinned root override is identical: the Expo SDK 57 native module set did not move, orval and @orval/zod held at 8.20.0 so the committed Zod snapshot stays comparable, and react, react-dom and react-test-renderer held. The only override-pinned package that moved is postcss 8.5.23 -> 8.5.26, whose override is the caret range ^8.5.18, so that is the pin working as designed. Two things npm did that the invocation did not ask for. A hoisted lockfile ignores --workspace scoping, so Expo build tooling moved with the sweep (@expo/cli 57.0.10 -> 57.0.14, @react-native/* 0.86.0 -> 0.86.2); all in-range, all still SDK 57, none in the pinned native set. And brace-expansion moved 1.1.18 -> 1.1.16, a downgrade, because the lockfile had drifted above its own exact security pin and re-resolution pulled it back. Validation: lint 3/3 with 0 errors, type-check 3/3, and 670 test files pass across all four workspaces. The suite needs --concurrency=1; at turbo's default the shared barrel-import test at types.test.ts:1943 exceeds its 15s timeout from machine contention alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
This was referenced Aug 11, 2026
Owner
Author
|
|
thomasluizon
changed the base branch from
fix/bump-vulnerable-transitive-deps
to
main
August 12, 2026 00:40
Owner
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
thomasluizon
added a commit
that referenced
this pull request
Aug 12, 2026
Resolves the squash-merge artifact from #713 and #714 landing on main. package.json: the overrides block conflicted because #713 was squashed, so git could not see that this branch already contains its exact pins. This branch's version is kept: it is #713's pins converted to caret ranges, which is the point of this PR, plus the react-native-device-info dedupe. No new resolution was invented. package-lock.json: regenerated with npm install rather than hand-merged. Verified after regeneration: js-yaml 4.3.1/3.15.1, nanoid 3.3.18, brace-expansion 1.1.18 everywhere, react-native-device-info a single copy at 10.3.0, and zero duplicate expo/react-native module copies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #673. Monthly non-security dependency freshness sweep for August 2026.
/dep-sweepwas deleted by #676 along with thedep-sweep-reminder.ymlthat filed this ticket, so the sweep was run by hand against the contract stated in the ticket body: bumpapps/web+packages/sharedminor/patch, deferapps/mobiletoexpo install --check, reportorbit-apiNuGet drift.What changed
package-lock.jsononly. Every bump was already inside an existing semver range, so nopackage.jsonedit was needed. 263 packages moved.Headline entries reaching product code:
next/eslint-config-next/@next/*@sentry/*(nextjs, react, node, core, …)@supabase/supabase-js+ auth/realtime/storage/postgrestreact-hook-form/@hookform/resolversnext-intl/use-intl/icu-minifylucide-reactandlucide-react-nativemotion/framer-motion/motion-domaxiosmarkedsonner@radix-ui/*(23 packages)Tooling:
typescript-eslint8.65.0 → 8.67.0,@playwright/test1.61.1 → 1.62.1,puppeteer-core25.3.0 → 25.6.0,vite8.1.5 → 8.2.1,rolldown1.1.5 → 1.2.3,esbuild0.28.1 → 0.28.2,turbo2.10.6 → 2.10.9,tsx4.23.1 → 4.23.12,eslint10.8.0 → 10.8.1,@types/node26.1.1 → 26.2.0,@types/react19.2.17 → 19.2.18.The pins that had to hold, and did
#599 recorded that regenerating this lockfile refloats transitives and that three floats were unacceptable. Checked explicitly, against the base commit rather than by eye:
expo,@expo/ui,@expo/dom-webview,@expo/log-box,expo-notifications,expo-router,expo-secure-store, and the rest) did not move. No SDK jump.orvaland@orval/zodheld at 8.20.0, so the committed Zod contract snapshot stays comparable and the generator header is unchanged.react/react-dom/react-test-rendererheld at 19.2.3 / 19.2.3 / 19.2.7.postcss8.5.23 → 8.5.26, and its override is deliberately the caret range^8.5.18, so that is the pin working as designed.js-yaml4.3.1 / 3.15.1,nanoid3.3.17,image-sizestill 1.2.1.Two things worth knowing
1.
--workspacescoping does not contain a hoisted lockfile. The update was invoked asnpm update --workspace apps/web --workspace packages/shared --workspace eslint-rules, but a single hoisted tree means Expo-adjacent build tooling moved with it:@expo/cli57.0.10 → 57.0.14,@expo/config57.0.6 → 57.0.7,babel-preset-expo57.0.4 → 57.0.6,expo-build-properties57.0.7 → 57.0.10,@react-native/*0.86.0 → 0.86.2. All are in-range and all stay inside SDK 57; none is in the pinned native module set. Flagging it rather than pretending the scope held.2.
brace-expansionmoved 1.1.18 → 1.1.16, a downgrade. This is the existing"brace-expansion@1": "1.1.16"override finally being applied: the lockfile had drifted above its own exact pin, and re-resolution pulled it back. Correct perpackage.jsonas written, but it shows the cost of pinning security overrides to an exact version rather than a caret. Left as-is here because changing the semantics of a security pin does not belong in a freshness sweep.apps/mobile: deferred toexpo install --check, reported not appliednpx expo install --checkreports 26 packages it would like aligned. Every one is still inside SDK 57; there is no SDK jump on offer.None of these is applied here, deliberately. Every one is held back by an exact pin in the root
overridesblock, and #599 put those pins there on purpose to keep the Android native module set identical. Applying them means rewriting that pin set and changing native modules, which cannot be validated by a JS test suite. That is a mobile-focused PR with an Android build behind it, not a freshness sweep. Recommend a follow-up ticket for the full SDK 57.0.x alignment.One residual risk, stated plainly
react-nativeitself stays pinned at 0.86.0, but six of its in-range tooling packages floated to 0.86.2:@react-native/codegen,@react-native/babel-plugin-codegen,@react-native/debugger-frontend,@react-native/debugger-shell,@react-native/dev-middleware,@react-native/normalize-colors. npm resolved them inside the rangesreact-native@0.86.0itself declares, and lint, type-check and all 242 mobile test files pass. But@react-native/codegenparticipates in the Android native build, which nothing in this repo's JS suite exercises. Expo wants core and tooling both at 0.86.2. This is the one change here I cannot prove safe from a green suite alone, so it should get an Android build before merge, or the six can be pinned back to 0.86.0 if you would rather the native surface stay byte-identical tomain.orbit-apiNuGet drift, reported not changedorbit-apiNuGet drift is reported, not changed (GitHub Actions + NuGet minor/patch are Dependabot auto-merge territory):Microsoft.*/ EF Core / ASP.NET 10.0.10 → 10.0.11 across Api, Application, Infrastructure and the test projectsStripe.net52.2.0 → 52.3.0,OpenAI2.12.0 → 2.13.0,PostHog2.12.1 → 2.13.1,PostHog.AspNetCore2.8.1 → 2.8.2,Scalar.AspNetCore2.16.17 → 2.16.18Microsoft.OpenApi2.11.0 → 3.9.0,ModelContextProtocol1.4.1 → 2.1.0,NSubstitute5.3.0 → 6.2.0Separate finding, not fixed here
apps/mobile/package.jsonstill carries a 21-entryoverridesblock that npm never applies, because overrides are honoured only from the root workspacepackage.json. #599 hoisted 7 of these; 4 remain orphaned:@react-native-masked-view/masked-view,expo-dev-menu-interface,expo-structured-headers,react-native-device-info. Three currently resolve to their intended version by coincidence of ranges, so hoisting them is a no-op. The fourth is not:react-native-sirenpullsreact-native-device-info8.7.1 where the dead override intends 10.3.0, so enforcing it is a real major-version change and needs its own ticket rather than a silent ride in a freshness sweep.🤖 Generated with Claude Code