Repository navigation
chore(security): clear all 13 npm audit advisories (lockfile-only) - #51
Conversation
Resolve 2 critical, 9 high, and 2 moderate advisories via `npm audit fix` (no --force) plus a within-range `npm update`. package.json is unchanged -- every fix fits the existing ^ ranges, so this is a lockfile-only bump with no application-logic changes. Key bumps: - next 16.2.9 -> 16.4.3 (critical chain incl. middleware/SSRF/DoS) - dompurify 3.4.10 -> 3.4.17 (critical; within isomorphic-dompurify ^3.3.1) - undici 7.27.2 -> 7.30.1, zod 4.4.3 -> 4.6.7 (high) - postcss 8.5.15 -> 8.5.31, @tailwindcss/postcss 4.3.1 -> 4.3.3 - sharp 0.34.5 -> 0.35.5, nanoid 3.3.12 -> 3.3.20 (high) - browserslist, js-yaml, source-map-js, brace-expansion, baseline-browser-mapping - react/react-dom 19.2.7 -> 19.3.1, eslint-config-next 16.2.9 -> 16.4.3 (match next) npm audit: 13 -> 0. Lint + smoke (split_routing and nextjs_first) GREEN. No major bumps: typescript 5.x, @types/node 22.x, eslint 9.x held in place. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c605b2d474
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "@emnapi/core": "^1.11.1", | ||
| "@emnapi/runtime": "^1.11.1", | ||
| "@emnapi/wasi-threads": "^1.2.2", |
There was a problem hiding this comment.
On wasm32-WASI installs, this 4.3.3 backend requires @emnapi/core ^1.11.1 and @emnapi/wasi-threads ^1.2.2, but the lock has only top-level versions 1.10.0 and 1.2.1 and no nested bundled entries. npm ls --package-lock-only --all reports these dependencies as invalid; npm documents that npm ls reports invalid packages. This leaves the optional backend's dependency tree outside its declared ranges and can break Tailwind builds on that platform; record the matching bundled versions under this package.
Useful? React with 👍 / 👎.
Security + dependency sweep
Clears every advisory reported by
npm auditon this repo. Lockfile-only change:package.jsonis untouched because every fix fits the existing^ranges. No application-logic changes.npm audit: 13 -> 0
Method:
npm ci->npm audit fix(no--force) -> within-rangenpm update.npm audit fixalone already reached 0; thenpm updatethen pulled the remaining within-range recipe bumps (react 19.3, eslint-config-next matched to next).Key bumps (all within existing ranges)
isomorphic-dompurify@2.36.0already allows^3.3.1, so no major bump of it was neededDeliberately left alone (no advisory forces a major)
Verification (GREEN)
npm run lint-> pass (exit 0)npm run build-> compiles successfully (exercised by smoke in both modes)npm run smoke->[smoke] OKon Next.js 16.4.3 for bothsplit_routingandnextjs_firstnpm audit-> 0 vulnerabilitiesNote: the scheduled e2e workflow (
e2e.yml) needs Docker + a live Drupal backend and is not part of the PR gate; it was not run here.Reverted / deferred
None. No bump broke the build or tests.
🤖 Generated with Claude Code