fix(deps): Clear 230 of the 323 open npm Dependabot alerts

[ovr]

Closes 230 of the 323 open npm Dependabot alerts across all five lockfiles, as 23 independently revertable commits — one logical change each, every one verified before the next was applied. Every fix is either a plain lockfile re-resolution or a direct bump of the parent that pinned the vulnerable version; no new resolutions entries were added (the only resolutions edit is raising the existing lodash floor from ^4.17.0 to ^4.18.0), because forcing qs@^6.16.0 that way turned out to break @cubejs-backend/api-gateway. Four dead dependencies came out along the way — cypress-plugin-snapshots, @ant-design/compatible (a CSS-only import dragging draft-js/immutable@3/node-fetch@1), and vizard's unused react-router-dom and toml — and aws-sdk v2, which hit end-of-support in September 2025, is gone entirely. .github/dependabot.yml was also pointed at the manifests that actually carry the alerts; it was scoped to /packages, so the root yarn.lock, docs-mintlify and the vizard lockfiles were never covered by version updates at all. The 93 that remain are structural: 44 are held by Angular 18's exact pins in cubejs-client-ngx (deliberately out of scope), 14 by node-gyp 9/10 under duckdb and @angular/cli, and the rest by upstream exact pins or have no patched release.

manifest	closed	still open	of
packages/cubejs-playground/vizard/yarn.lock	47	0	47
.../vizard/apps/react-typescript-antd-table/yarn.lock	31	0	31
.../vizard/apps/react-typescript-chartjs-.../yarn.lock	31	0	31
docs-mintlify/yarn.lock	58	6	64
root yarn.lock	61	79	140
package.json manifests	2	8	10
total	230	93	323

Largest single wins: vite 5 -> 7 in vizard (45), testcontainers 10 -> 12 (12 undici), dropping cypress-plugin-snapshots (10), regenerating docs-mintlify on mintlify@4.2.887 (58), express -> 4.22.2 (6), and @ant-design/compatible (4).

Check List

• Tests have been run in packages where changes have been made if available
• Linter has been run for changed code
• Tests for the changes have been added if not covered yet
• Docs have been added / updated if required

Verification

yarn install --frozen-lockfile is a no-op after every commit, plus yarn tsc, yarn lint and yarn build. Unit suites: api-gateway 284/284, shared 455/455, query-orchestrator 146/146, server-core 117/117, clickhouse-driver 90/90, vue3 36/36, cubestore-driver 22/22, base-driver 17/17, plus cli/server/dremio/duckdb/ksql/pinot/trino/athena/crate/jdbc/prestodb/snowflake/sqlite/cloud/react/playground/maven/aurora — all green. Docker-backed: postgres-driver 12/12, mysql-driver 5/5, cubestore 3/3, and mysql-aurora-serverless-driver 3/3 against a real local-data-api + MySQL 5.6 stack, which is what proves the aws-sdk v2 -> v3 migration. yarn build:vizard builds both app templates, both download zips and the preview site.

Two suites fail identically on origin/master with the same tree, so neither is a regression: schema-compiler fails the same 12 of 954 tests on both, and @cubejs-backend/native fails the same 3 SQLInterface tests on both (a stale index.node copied from another checkout).

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
cubed3	🟢 Ready	View Preview	Sep 11, 2026, 4:45 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[claude]

Claude finished @ovr's task in 7m 18s —— View job

---

Review: solid, well-sequenced dependency PR — 2 medium, 2 low, 1 verification gap

Full review

• Gather PR context & diff
• Review non-lockfile source changes (aurora-serverless driver, playground, vizard, cypress)
• Review dependency/manifest changes for semver & breaking-change risk
• Review .github/dependabot.yml
• Verify lockfile/manifest consistency
• Post findings

What I checked

The interesting surface here isn't the lockfile churn, it's the handful of major bumps on packages with real call sites. I traced each one to its consumer:

bump	call site	verdict
@octokit/core 3 → 5	rust/cubestore/js-wrapper/src/download.ts:19	⚠️ proxy regression (below)
aws-sdk v2 → @aws-sdk/client-rds-data	AuroraServerlessMySqlDriver.js:63	works; breaking user-facing options shape
@google-cloud/storage 7 → 8	gcs.fs.ts, BigQueryDriver.unload()	unverified export-bucket path
sqlite3 5 → 6	SqliteDriver.js:42 (new Database, db.all)	fine; API untouched, engines already >=20
xmlbuilder2 2 → 4	maven.ts:23 (create().ele().txt().up())	fine
js-cookie 2 → 3	events.ts (get/remove)	fine; v3 ships its own types, and the existing <string> cast covers string | undefined
testcontainers 10 → 12	no removed APIs in use (withHealthCheck, withEnvironment, DockerComposeEnvironment all still current); @testcontainers/kafka moved in lockstep	fine
@cubejs-client/* 0.35 → 1.7.37 in vizard templates	import cube from '@cubejs-client/core' — default export still present at client-core/src/index.ts:1016, WebSocketTransport default at ws-transport/src/index.ts:269	fine

Dead-code removals all verified clean: no remaining references to @ant-design/compatible, cypress-plugin-snapshots, react-router-dom or toml. The dropped @ant-design/compatible/assets/index.css import was the only style import in the playground besides graphiql, but antd's stylesheet comes from <link rel="stylesheet" href="/antd.min.css"> in index.html, so styling isn't load-bearing on that import. chart.js/react-chartjs-2 really are unused in the antd-table template, and its old name (vizard-react-typescript-chartjs) isn't referenced anywhere, so the rename is safe.

Lockfile/manifest consistency spot-checked: every new range resolves (testcontainers@^12.1.0 → 12.1.0, @testcontainers/kafka@~12.1.0 → 12.1.0, express@^4.22.2 → 4.22.2, lodash → 4.18.1, @aws-sdk/client-rds-data, @google-cloud/storage@^8.1.0, xmlbuilder2@^4.0.3, js-cookie@^3.0.7, mintlify@^4 → 4.2.887), and aws-sdk is genuinely absent from both the root lockfile and every manifest. qs@~6.15.1 → 6.15.3 does survive, consistent with the PR description's note about not forcing qs@^6.16.0.

.github/dependabot.yml looks right, and the reasoning in the description holds up: root workspaces is ["rust/*", "packages/*"], so / covers every workspace member, while docs-mintlify and packages/cubejs-playground/vizard{,/apps/*} are outside those globs and genuinely needed their own entries. The old directory: "/packages" had no package.json to point at at all. Optional nit: four directories on a weekly schedule against the default open-PR limit of 5 may crowd out each other — a groups block (as the github-actions entry already has) would keep it tidy.

Findings

Medium — @octokit/core 5 silently drops proxy support (thread). @octokit/request 5.6.3 depended on node-fetch@^2 and forwarded request.agent; 8.4.1 has no fetch dep at all and uses global fetch, which ignores agent. @octokit/types still types agent?: unknown, so yarn tsc passes and it breaks only at runtime, only behind a proxy, only on the 404 release-metadata fallback. Pinning to 5 rather than 6/7 was the right call for CJS (before-after-hook@^2, universal-user-agent@^6 are still dual) — it's the fetch migration inside the 5 line that bites. Same thread also notes rust/cubestore's engines still advertises Node 12/14/16 while @octokit/core@5 needs ≥ 18.

Medium — the Aurora driver's options is a breaking public-API change with nothing recording it (thread). options flows into new RDSDataClient(...) now, so user configs with sslEnabled/httpOptions/maxRetries/top-level credentials stop working. The migration is correct — I confirmed downloadQueryResults' transaction() path is covered by the integration test you ran, and CI's mysql-aurora-serverless matrix entry will exercise it — but there's no doc page for this driver, so it needs a README note plus a breaking-change callout.

Low — stale @types/data-api-client@^1.2.1 (same thread). Describes the v1 surface and pulls @types/aws-sdk2-types, re-adding the aws-sdk v2 typings this PR removes; nothing imports it.

Low — directories PR-volume nit on .github/dependabot.yml (above).

Verification gap — GCS v8 (thread). The export-bucket paths (bucket.getFiles, file.getSignedUrl, createExtractJob) aren't reachable from any suite in the verification list. Worth one confirmation from the bigquery integration job.

Praise

23 commits that each do one thing and each got verified before the next went on is the right shape for a PR this size, and it's what made this reviewable at all. Adding no new resolutions — and reporting that qs@^6.16.0 broke api-gateway rather than forcing it — is the correct instinct. Calling out the two suites that fail identically on origin/master pre-empts exactly the question a reviewer would otherwise ask.

No prior review threads existed on this PR, so nothing to resolve or dedupe against.

· branch [`dependabot-js-alerts-table`](https://github.com/cube-js/cube/tree/dependabot-js-alerts-table)

[claude]

@octokit/core 3 → 5 silently drops proxy support for the release lookup.

js-wrapper/src/download.ts:19-24 passes request.agent = await getHttpAgentForProxySettings(), which is a proxy-agent http.Agent.

• On master, @octokit/core@3 → @octokit/request@5.6.3, which depends on node-fetch@^2.6.7 and forwards agent — so HTTP_PROXY/HTTPS_PROXY was honored.
• With @octokit/core@5.2.2 → @octokit/request@8.4.1 (no node-fetch/undici dep — it uses global fetch), the agent option is no longer forwarded; native fetch ignores it.

@octokit/types still declares agent?: unknown on RequestRequestOptions, so this compiles and typechecks and fails only at runtime, for users behind a proxy, on the 404 fallback path that resolves release metadata. The primary downloadAndExtractFile path is unaffected, which makes it easy to miss.

Fix direction: pass a custom request.fetch that applies an undici ProxyAgent as dispatcher (add a helper alongside getHttpAgentForProxySettings), or leave @octokit/core on 3 in this commit if the fetch-based proxy plumbing is out of scope for a dependency PR.

Also engines (line 7-9) still claims ^12.0.0 || ^14.0.0 || >=16.0.0; @octokit/core@5 requires Node ≥ 18. Worth aligning with the >=20.0.0 the other packages declare.

[claude]

This retypes a published config surface, and the shape change is user-visible: options is handed straight to dataApi({ ..., options }), which under data-api-client@2 becomes new RDSDataClient(options) instead of new AWS.RDSDataService(options).

So any existing cube.js using v2-style keys breaks silently or throws — sslEnabled, httpOptions, maxRetries, and top-level accessKeyId/secretAccessKey are all gone in v3 (credentials: { ... }, requestHandler, maxAttempts instead). The test diff is exactly that migration, so the delta is known; it just isn't recorded anywhere a user would see it.

There's no docs page for this driver (nothing matches aurora under docs-mintlify/), so a short note in the driver's README plus a release-note/breaking-change callout is probably the cheapest place to land it.

Relatedly, @types/data-api-client@^1.2.1 is still in devDependencies: it describes the v1 surface and pulls @types/aws-sdk2-types, quietly re-adding the aws-sdk v2 typings this PR set out to remove. Nothing imports it (the driver is plain JS and this .d.ts is hand-written), so it looks droppable.

[claude]

@google-cloud/storage 7 → 8 is the one major here whose code paths aren't in the verification list. The consumers are src/storage-fs/gcs.fs.ts (new Storage(...), bucket.getFiles, file.getSignedUrl) and BigQueryDriver.unload() (bucket.file() → createExtractJob → getFiles → getSignedUrl) — export-bucket-only code that no unit suite touches, and base-driver 17/17 won't exercise it.

engines is >=20.0.0 here so the Node floor is fine. Could you confirm the bigquery integration job with an export bucket configured came back green (or run the GCS unload path once by hand)? Everything else in this PR has a green suite behind it; this is the gap.