fix(deps): resolve production audit advisories - #2049
Conversation
Clears all findings from `pnpm run audit --prod`: - fast-uri: bump override 3.1.2 -> 3.1.4 (GHSA-4c8g-83qw-93j6, high; transitive via api > fastify). - hono: add override 4.12.31 (GHSA-w62v-xxxg-mg59, XSS in cx()). - @graphql-codegen/client-preset: move from api dependencies to devDependencies. It only backs `preset: 'client'` in api/codegen.ts (build-time) and is never imported at runtime; web already declares it as a devDependency. This drops the immutable DoS advisory (GHSA-xvcm-6775-5m9r) out of the production graph. - shadcn-vue: move from unraid-ui dependencies to devDependencies. It is a component-scaffolding CLI referenced only in the README/components.json and never imported at runtime. This drops the @hono/node-server path traversal advisory (GHSA-frvp-7c67-39w9) out of the production graph. pnpm run audit --prod now exits 0 with zero advisories.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev |
|
This plugin has been deployed to Cloudflare R2 and is available for testing. |
🔄 PR Merged - Plugin Redirected to StagingThis PR has been merged and the preview plugin has been updated to redirect to the staging version. For users testing this PR:
Staging URL: Thank you for testing! 🚀 |
🤖 I have created a release *beep* *boop* --- ## [4.36.1](v4.36.0...v4.36.1) (2026-07-22) ### Bug Fixes * **ci:** make dependency audit non-blocking ([#2048](#2048)) ([9db6c38](9db6c38)) * **deps:** resolve production audit advisories ([#2049](#2049)) ([e5654cc](e5654cc)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2049 +/- ##
==========================================
+ Coverage 52.92% 52.94% +0.01%
==========================================
Files 1035 1035
Lines 72122 72122
Branches 8313 8317 +4
==========================================
+ Hits 38169 38183 +14
+ Misses 33826 33812 -14
Partials 127 127 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Summary
Clears every finding from
pnpm run audit --prod(which now exits 0 with zero advisories), addressing the vulnerabilities that turned the 4.36.0 release run red. Companion to #2048, which stops audit findings from blocking publishing; this one removes the findings themselves.Changes
fast-uri(viaapi > fastify)pnpm.overridespin3.1.2 → 3.1.4hono(via MCP SDK)pnpm.overridespin4.12.31immutable(via@graphql-codegen/client-preset)client-presettodevDependencies@hono/node-server(viashadcn-vue)shadcn-vuetodevDependenciesWhy the dependency moves (instead of forcing overrides)
immutablehas no patched 3.x (fix requires the 4.x major) and@hono/node-serverrequires the 2.x major — forcing either global override risks breaking the codegen/relay-compiler and MCP SDK toolchains. Both advisories reach--prodonly because their carriers were mislabeled as runtime dependencies:@graphql-codegen/client-presetbackspreset: 'client'inapi/codegen.ts(build-time codegen) and is never imported at runtime. Its eight sibling@graphql-codegen/*packages — andweb's copy ofclient-presetitself — are alreadydevDependencies. This just fixes the inconsistency.shadcn-vueis a component-scaffolding CLI referenced only inunraid-ui's README andcomponents.json; it is never imported by the built library.Moving them to
devDependenciesis correct hygiene and takes both advisories out of the production graph without a risky major bump. They remain installed for dev/CI, so codegen and component scaffolding are unaffected.Verification
pnpm install --lockfile-onlysucceeds; lockfile resolvesfast-uri@3.1.4andhono@4.12.31.pnpm run audit --prod→ exit 0,{info:0, low:0, moderate:0, high:0, critical:0}.api/srcandunraid-ui/src).