Skip to content

fix(deps): Resolve Dependabot security alerts #17998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sfanahata merged 1 commit into from
Jun 24, 2026
Merged

fix(deps): Resolve Dependabot security alerts #17998

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 15 additions & 10 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@
"@types/mdx": "^2.0.9",
"algoliasearch": "^4.23.3",
"classnames": "^2.5.1",
"dompurify": "3.3.2",
"dompurify": "3.4.11",
"esbuild": "^0.28.1",
"framer-motion": "^10.12.16",
"github-slugger": "^2.0.0",
Expand All @@ -78,8 +78,8 @@
"hast-util-to-string": "^3.0.1",
"hastscript": "^8.0.0",
"image-size": "^1.2.1",
"js-cookie": "^3.0.5",
"js-yaml": "^4.1.0",
"js-cookie": "^3.0.7",
"js-yaml": "^4.2.0",
"match-sorter": "^6.3.4",
"mdast-util-from-markdown": "^2.0.2",
"mdast-util-to-markdown": "^2.1.2",
Expand Down Expand Up @@ -136,7 +136,6 @@
"@spotlightjs/spotlight": "^2.5.0",
"@tailwindcss/forms": "^0.5.7",
"@tailwindcss/typography": "^0.5.10",
"@types/dompurify": "3.0.5",
"@types/hast": "^3.0.4",
"@types/mdast": "^4.0.4",
"@types/node": "^22",
Expand Down Expand Up @@ -165,21 +164,27 @@
"ts-node": "^10.9.1",
"tsx": "^4.22.0",
"typescript": "^5",
"vite": "^7.3.5",
"vite-tsconfig-paths": "^5.0.1",
"vitest": "^4.1.0",
"ws": "^8.17.1"
"ws": "^8.21.0"
},
"pnpm": {
"overrides": {
"dompurify": "3.3.2",
"@types/dompurify": "3.0.5",
"dompurify": "3.4.11",
"@types/node": "^22",
"immutable": "^5.1.5",
"flatted": "^3.4.2",
"rollup": "^4.59.0",
"fast-xml-parser": "^5.5.7",
"undici": "^6.24.0",
"minimatch": "^9.0.0"
"fast-xml-parser": "^5.7.0",
"undici": "^6.27.0",
"minimatch": "^9.0.0",
"postcss": "^8.5.10",
"uuid": "^11.1.1",
"shell-quote": "^1.8.4",

@sentry sentry Bot Jun 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Forcing uuid to v11.1.1 via an override may break transitive dependencies like @google-cloud/storage, which expect an older version and its default export.
Severity: HIGH

Suggested Fix

Remove the global override for uuid in package.json. If a specific version is needed for a direct dependency, address it there. Otherwise, allow the package manager to resolve the correct uuid version for each dependency, like @google-cloud/storage, to ensure it receives a compatible version (e.g., v8 or v9) that includes the expected default export.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: package.json#L184

Potential issue: The `uuid` package is being forced to version 11.1.1 via a
`package.json` override. This version of `uuid` removes the default export, which is a
breaking change from versions like v8 and v9. A transitive dependency,
`@google-cloud/storage@7.19.0`, was built for `uuid@^8.0.0` and may rely on the
now-removed default export. If `@google-cloud/storage` uses the old `require('uuid')`
import pattern, it will fail at runtime when any of its functions that internally use
`uuid` are called, leading to potential application crashes.

Did we get this right? 👍 / 👎 to inform future reviews.

@sfanahata sfanahata Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a false positive:

The default export was actually removed in uuid 10.0.0, but none of these packages use it. They all use v4 as a named export, which uuid 11.x fully supports. I confirmed this with runtime smoke tests from each consumer's dependency context after a clean node_modules reinstall.

"launch-editor": "^2.14.1",
"form-data": "^4.0.6",
"vite": "^7.3.5"
},
"onlyBuiltDependencies": [
"@parcel/watcher",
Expand Down
Loading
Loading