[dev] [Marfuen] mariano/security-dependency-upgrades-2 - #3405
Closed
github-actions[bot] wants to merge 3 commits into
Closed
[dev] [Marfuen] mariano/security-dependency-upgrades-2#3405github-actions[bot] wants to merge 3 commits into
github-actions[bot] wants to merge 3 commits into
Conversation
Reduce `bun audit` findings from 165 (4 critical / 58 high) to 44 (0 critical / 17 high) by bumping direct deps and adding root overrides for transitive ones. bun.lock regenerated via `bun install`. Direct bumps (vulnerable instance was the direct dep): - better-auth 1.4.22 -> ^1.6.13 (CVE-2026-53512, CVSS 9.1 OAuth refresh-token replay; mcp/oidcProvider plugin is enabled in apps/api) - next ->^16.2.6 (middleware/proxy bypass, SSRF, DoS) - axios ->^1.16.0 (proxy-auth credential leak, prototype pollution) - vitest ->^3.2.6, vite ->^6.4.3, turbo ->^2.10.5 Root overrides for transitive vulns (backcompat-safe versions only): axios, vitest/@vitest/{coverage-v8,ui}, form-data, ws, semver, hono, @hono/node-server, multer, systeminformation, tmp, dompurify, ip-address, postcss, prismjs, qs, effect, protobufjs, linkify-it, mermaid, shell-quote, vite. undici intentionally NOT overridden: discord.js/@discordjs/rest pin undici@6 and use its internals; forcing v7 would break them at runtime. Verified: all production/source code typechecks clean across every workspace. Remaining typecheck errors are pre-existing .spec.ts test debt on main (unchanged source + unchanged jest/@types/node/trigger). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Follow-up to the initial security pass. Clears the safely-fixable residuals so bun audit drops from 44 to 16 (0 critical / 10 high / 3 moderate / 3 low). All changes stay within declared version ranges. Dead-dep removal (unused, referenced by no script): - gitmoji -> cascade-drops request, tough-cookie@2.5.0, tar@2.2.2, node-gyp@3.8.0 - semantic-release-discord + -notifier -> drops discord.js/@discordjs/rest (which pinned undici@6 and blocked patching it) Parent bumps: - @browserbasehq/stagehand ^3.2.1/^3.0.5 -> ^3.7.0 (drops langchain + langsmith entirely) - @nestjs/swagger ^11.2.0 -> ^11.4.5 (pulls patched js-yaml 4.3.0) Overrides (backcompat-safe, verified): - @opentelemetry/core ^2.8.0, @sigstore/core 3.2.1, markdown-it ^14.3.0, @babel/core ^7.29.7 - @tiptap/* pinned 3.22.1 (lockstep — the lockfile refresh floated the transitive @tiptap/* to 3.27.4, incompatible with @tiptap/react 3.22.1) Lockfile refresh floats the remaining stale transitives to patched in-range versions: undici 6.27.0/7.28.0, js-yaml 3.15.0/4.3.0, brace-expansion, minimatch (non-bundled copies), @sigstore/verify 3.1.1. Verified: full `turbo build` (20/20) + typecheck (0 production errors) across all apps; apps/api Dockerfile.multistage builds clean and boots past module-load (better-auth 1.6 loads; stops only at the expected SECRET_KEY env guard). Remaining 16 are all dev/build-time or no-upstream-fix: tar (electron-builder/giget/npm-bundled), minimatch (npm-bundled), esbuild (dev-server only), uuid (exceljs, no v8 fix), sigstore (release CI), cookie (disjoint majors), @ai-sdk/provider-utils (low, via stagehand). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated pull request to merge mariano/security-dependency-upgrades-2 into dev.
It was created by the [Auto Pull Request] action.
Summary by cubic
Upgrade dependencies across the monorepo to patch security vulnerabilities and cut
bun auditfindings from 165 to 16. No functional changes expected.better-auth-> ^1.6.13,next-> ^16.2.6,axios-> ^1.16.0,@browserbasehq/stagehand-> ^3.7.0,@nestjs/swagger-> ^11.4.5,vitest-> ^3.2.6,vite-> ^6.4.3,turbo-> ^2.10.5.overridesto force patched transitives (e.g.,axios,ws,semver,postcss,qs,dompurify,hono/@hono/node-server,multer,protobufjs,markdown-it) and pinned@tiptap/*to 3.22.1 for compatibility.gitmoji,semantic-release-discord,semantic-release-discord-notifier.bun.lock.Written for commit b5eaaa8. Summary will update on new commits.