chore(deps): resolve all Dependabot security advisories (v1.8.9) - #144
Merged
Conversation
Run npm audit fix to bring transitive dependencies up to patched versions. package.json is unchanged — all updates are in-range resolutions in package-lock.json. Notable bumps: - tar 7.5.x -> 7.5.22 (critical: PAX file smuggling, plus 5 DoS advisories) - undici -> 7.29.0 (TLS cert validation bypass, cache poisoning, header injection) - ws -> 8.21.3 (uninitialized memory disclosure, memory exhaustion DoS) - brace-expansion -> 1.1.18 (DoS via unbounded expansion) - electron 42.3.3 -> 42.9.1 - electron-builder / app-builder-lib 26.8.1 -> 26.15.3 - js-yaml 4.3.1, postcss 8.5.26, rollup 4.62.4, nanoid 3.3.18, form-data, ip-address, minimatch, picomatch, @babel/core npm audit now reports 0 vulnerabilities. Verified: typecheck, 411 tests, vite build, and electron-builder packaging (build:unpack) all pass. The electron-builder bump drops the app-builder-bin/7zip-bin native binaries in favor of @napi-rs/lzma, which accounts for most of the lockfile churn.
📊 Coverage Report
|
🧪 E2E Test Results✅ 18 passed, 0 failed, 0 skipped
|
dantheuber
changed the title
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings every transitive dependency flagged by Dependabot up to a patched version via
npm audit fix.package.jsonis unchanged — all updates are in-range resolutions inpackage-lock.json.npm auditnow reports 0 vulnerabilities (was 25: 1 critical, 21 high, 1 moderate, 2 low).Notable bumps
tarundiciwsbrace-expansionelectronelectron-builder/app-builder-libjs-yamlpostcssrollupnanoidPlus
form-data,ip-address,minimatch,picomatch,@babel/core.On the lockfile churn
The diff is large (+937 / −2132) relative to the change. Most of it is the
electron-builder26.8.1 → 26.15.3 bump, which drops theapp-builder-bin/7zip-binnative binary packages in favor of@napi-rs/lzma, plus general deduplication of nested transitive copies. Net package count went 875 → 783.Because that touches the packaging toolchain, I verified the release path rather than just the test suite.
Verification
npm run typecheck— passesnpm test— 411 tests / 25 files passnpm run build— passesnpm run build:unpack— electron-builder packages successfully (dist/linux-unpacked/cliplessproduced, app.asar intact)Only linux packaging was exercised locally; win/mac builds go through CI.