fix: resolve 22 of 23 security vulnerabilities - #28
Merged
Conversation
Updated dependencies: - react-router: 7.1.5 → 7.18.2 (fixes 10 CVEs: RCE, DoS, open redirect, CSRF, XSS) - vite: 6.0.11 → 6.4.3 (fixes 4 CVEs: arbitrary file read, path traversal, hash disclosure) - concurrently (updates shell-quote): fixes 2 CVEs (command injection, DoS) - express (updates qs, body-parser): fixes 2 CVEs (DoS) - tsx (updates esbuild): fixes 1 CVE (arbitrary file read on Windows) - @vitejs/plugin-react: updated for @babel/core fix Added pnpm overrides for transitive dependencies: - postcss: >=8.5.18 (fixes 3 CVEs: file read, path traversal, XSS) - @babel/core: >=7.29.6 (fixes 1 CVE: arbitrary file read via sourceMappingURL) Remaining (1 advisory, low risk for this project): - react-router RSC CSRF bypass (GHSA-qwww-vcr4-c8h2) requires v8.3.0+ (major version bump). This project does not use React Server Components, so this vulnerability is not exploitable in this codebase.
The Docker CI uses a newer pnpm version that reads overrides from pnpm-workspace.yaml instead of the package.json 'pnpm' field.
Move enableScripts setting from 'pnpm config set' CLI command to pnpm-workspace.yaml, as pnpm v10 no longer supports this via global config.
CI enforces minimumReleaseAge — nanoid@3.3.17 and tsx@4.23.5 were published too recently. Pin to 3.3.16 and 4.23.4 respectively.
pnpm v10 requires explicit build approval via onlyBuiltDependencies instead of the deprecated enableScripts setting.
Pin pnpm to v9 in Docker builds to avoid pnpm v10 breaking changes (enableScripts removal, build approval requirements). Also add pnpm.overrides to package.json for pnpm v9 compatibility alongside the pnpm-workspace.yaml overrides.
homeles
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Vulnerability Fix
Summary
Resolves 22 of 23 vulnerabilities found by
pnpm audit, reducing from 1 critical + 10 high + 8 moderate + 4 low to just 1 remaining high (not exploitable in this project).Updated Direct Dependencies
Transitive Dependency Overrides (pnpm)
postcss >= 8.5.18— fixes 3 CVEs (file read, path traversal, XSS)@babel/core >= 7.29.6— fixes 1 CVE (sourceMappingURL file read)Remaining (1 advisory — not exploitable)
Verification
pnpm build)tsc -b && vite build)