fix(PT9-1372): resolve dependabot security alerts - #28
Merged
rharutyunyan merged 3 commits intoAug 24, 2026
Conversation
Pin vulnerable transitive packages via yarn resolutions and pnpm overrides, refresh both lockfiles, and add ai-dev-toolkit symlinks so the security-fix skill is available in this repo. Co-authored-by: Radik Harutyunyan <rharutyunyan@users.noreply.github.com>
GitHub retired ubuntu-20.04, so the ci job stayed queued and never started. Co-authored-by: Radik Harutyunyan <rharutyunyan@users.noreply.github.com>
Keep the Dependabot pins and CI runner fix; do not publish internal agent/skill/symlink wiring on a public repository. Co-authored-by: Radik Harutyunyan <rharutyunyan@users.noreply.github.com>
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Summary
What does this PR change?
Resolves the open Dependabot alerts in
yarn.lockandpnpm-lock.yamlwith yarn resolutions and version-scoped pnpm overrides. Moves the PR CI job from retiredubuntu-20.04toubuntu-22.04so GitHub Actions can start a runner.Related Issue/Ticket:
https://1inch.atlassian.net/browse/PT9-1372
Testing & Verification
How was this tested?
yarn audit --level moderatereported 0 vulnerabilitiespnpm audit --audit-level moderatereported no known vulnerabilitiesyarn install --frozen-lockfileandpnpm install --frozen-lockfileboth succeededyarn run ci-pipeline(lint, jest, typecheck) passedRisk Assessment
Risk Level:
Risks & Impact
None. Runtime library code is unchanged. Fixes are transitive dependency pins plus a webpack 5.x bump (dev-only, via
ts-loader).serialize-javascriptleft the tree because webpack 5.104.1 / terser-webpack-plugin 5.6.1 no longer depends on it. The workflow runner change is CI-only.Fixed
yarn.lock
pnpm-lock.yaml
Same packages as above, plus:
Changes Made
resolutionsand pnpmoverridesinpackage.json(scoped + major-capped).yarn.lockandpnpm-lock.yaml..github/workflows/pr.ymlfrom retiredubuntu-20.04toubuntu-22.04.QA: pass (
yarn run ci-pipeline, both audits clean).