Bump dependencies to patched versions (security bundle)#43
Conversation
Extend yarn resolutions to pull in patched transitive dependencies and bump axios, closing the outstanding npm Dependabot security PRs without touching the build toolchain. lodash floats to 4.18.1, which also clears the recent lodash advisory (<= 4.17.23). Verified: production build succeeds on the node:8 toolchain; unit tests pass (the one snapshot diff is a pre-existing stale fixture, unrelated). Deferred to the toolchain modernization: node-sass 7 / react-dev-utils 11 (need webpack 4+) and the Python deps (need a newer base than 3.5).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 056e9c71d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "dot-prop": "^4.2.1", | ||
| "node-sass": "^4.13.1", | ||
| "elliptic": "^6.5.3", | ||
| "node-sass": "^4.14.1", |
There was a problem hiding this comment.
This resolution does not upgrade the top-level devDependencies.node-sass entry, which still requests ^4.9.3; the checked-in lockfile therefore still contains node-sass@^4.9.3 resolved to 4.12.0 at react_app/yarn.lock:5096. In install paths that use the app's direct dev dependency, the security bundle leaves the older node-sass installed while adding a separate 4.14.1 lock entry, so this patch does not actually remove the vulnerable direct dependency unless the devDependency range is bumped too.
Useful? React with 👍 / 👎.
1 participant
What
Bundles the outstanding npm Dependabot security updates into one change by extending the existing yarn
resolutionsblock (plus anaxiosbump), so the vulnerable transitive versions are removed fromyarn.lock. Each corresponding Dependabot PR should auto-close once this merges.No build-toolchain changes — webpack 3 / babel 6 / node-sass 4.x stay put, so the build is unaffected.
Verification
Built against the actual deploy toolchain (
node:8, theDockerfile-webbase):yarn installregenerates the lock with patched versionsyarn build✅ succeeds (production bundle emitted)yarn test✅ 14/15 (the 1 failure is a pre-existing stale snapshot —linkifyexpects the oldsteemit.comdomain; unrelated to deps and not run at deploy time)Key bumps (via
resolutions, unless noted)Expected to auto-close
Dependabot PRs: #40 #39 #37 #36 #35 #34 #31 #26 #25 #22 #21 #19 #17 #14 #12 #10 #9
Deferred (require modernization, not this PR)
These, plus the remaining build-tooling alerts (webpack/babel/loader-utils/etc., which never ship to the browser), are best handled in a follow-up modernization PR.