Skip to content

chore: resolve open dependabot security alerts - #582

Open
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts
Open

chore: resolve open dependabot security alerts#582
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

Copy link
Copy Markdown
Member

Summary

Resolved 3 of 4 open Dependabot security alerts by bumping vulnerable dependencies via yarn resolutions.

Dependabot Alerts Resolved

Alert Package Severity Fix
#280 brace-expansion high Resolution bumped to ^5.0.8; resolves to 5.0.9
#279 tar medium Resolution bumped to ^7.5.21; resolves to 7.5.22
#278 postcss high Resolution bumped to ^8.5.18; resolves to 8.5.25

Unresolved Alert

Alert Package Severity Reason
#276 sharp high Previously reverted in #580 due to LGPL-licensed libvips artifact bundled in sharp 0.35.x prebuilds. Requires manual investigation before re-attempting.

Test plan

  • yarn build passes
  • yarn test:ci passes (44 test files, 189 tests)
  • Lockfile resolves all three packages to patched versions

- brace-expansion 5.0.7 -> 5.0.9 (high, alert #280)
- tar 7.5.19 -> 7.5.22 (medium, alert #279)
- postcss 8.5.14 -> 8.5.25 (high, alert #278)
Copilot AI review requested due to automatic review settings July 30, 2026 13:43
@jonathannorris
jonathannorris requested a review from a team as a code owner July 30, 2026 13:43

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses Dependabot-reported security vulnerabilities by updating Yarn resolution overrides so transitive dependencies resolve to patched versions across the CLI.

Changes:

  • Bump brace-expansion via Yarn resolutions to ^5.0.8 (lockfile resolves to 5.0.9).
  • Bump tar via Yarn resolutions to ^7.5.21 (lockfile resolves to 7.5.22).
  • Bump postcss via Yarn resolutions to ^8.5.18 (lockfile resolves to 8.5.25, including updated transitive nanoid range).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Updates Yarn resolutions entries to force patched versions of vulnerable transitive dependencies.
yarn.lock Updates lockfile entries so the resolved versions match the new patched resolution targets.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs
devcycle-mcp-server da041f4 Jul 30 2026, 01:45 PM

@jonathannorris
jonathannorris requested a review from suthar26 July 30, 2026 18:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants