Skip to content

chore: resolve open dependabot security alerts - #1218

Merged
jonathannorris merged 4 commits into
mainfrom
chore/dependabot-alerts
Jun 1, 2026
Merged

chore: resolve open dependabot security alerts#1218
jonathannorris merged 4 commits into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

@jonathannorris jonathannorris commented May 20, 2026

Copy link
Copy Markdown
Member

Summary

Resolved 14 open Dependabot security alerts (medium severity) by bumping vulnerable dependencies and adding yarn resolutions/overrides.

Dependabot Alerts Resolved

Alert Package Severity Fix
#1114 uuid medium Bumped to ^11.1.1 in sdk/js/package.json
#1113 uuid medium Bumped to ^11.1.1 in root package.json
#1112 qs medium Added resolution qs@6.14.0: ^6.15.2 to root package.json (lockfile)
#1111 qs medium Fixed by lockfile regeneration from e2e/js/js-esm resolution
#1110 qs medium Fixed by lockfile regeneration from e2e/react resolution
#1109 uuid medium Fixed by root uuid: ^11.1.1 resolution in lockfile
#1108 uuid medium Added resolution uuid: ^11.1.1 to e2e/nextjs/pages-router/app/package.json
#1107 uuid medium Added resolution uuid: ^11.1.1 to e2e/nextjs/app-router/app/package.json
#1106 uuid medium Added resolution uuid: ^11.1.1 to e2e/react/package.json
#1105 uuid medium Added resolution uuid: ^11.1.1 to e2e/js/js-esm/package.json
#1104 webpack-dev-server medium Bumped to ^5.2.4 in e2e/react/package.json
#1103 webpack-dev-server medium Bumped to ^5.2.4 in e2e/js/js-esm/package.json
#1102 webpack-dev-server medium Added resolution ^5.2.4 to root package.json (pulled by @nx/webpack)
#1101 webpack-dev-server medium Fixed by lockfile regeneration from e2e/js/js-esm update

- webpack-dev-server ^5.2.1 -> ^5.2.4 in e2e/react (medium, alerts #1101-#1104)
- webpack-dev-server ^4.15.2 -> ^5.2.4 in e2e/js/js-esm (medium, alerts #1101-#1104)
- webpack-dev-server resolution >=5.2.4 added to root package.json (medium, alert #1102)
@jonathannorris
jonathannorris requested a review from a team as a code owner May 20, 2026 13:42
Copilot AI review requested due to automatic review settings May 20, 2026 13:42
@vercel

vercel Bot commented May 20, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
js-sdks-web-elements Ready Ready Preview, Comment May 26, 2026 3:17pm
js-sdks-with-provider Ready Ready Preview, Comment May 26, 2026 3:17pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
js-sdks-next-js-page-router Ignored Ignored May 26, 2026 3:17pm

Request Review

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates vulnerable webpack-dev-server dependencies to patched versions across the root workspace and E2E apps to address Dependabot security alerts (CVE-2026-6402), primarily by moving to webpack-dev-server@5.2.4 and regenerating lockfiles.

Changes:

  • Bumped webpack-dev-server to ^5.2.4 in e2e/react and e2e/js/js-esm.
  • Added a root Yarn resolutions override to ensure transitive webpack-dev-server is at least 5.2.4 (pulled by @nx/webpack).
  • Regenerated lockfiles to reflect the updated dependency graph.

Reviewed changes

Copilot reviewed 3 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
yarn.lock Locks root workspace dependency graph to include webpack-dev-server@5.2.4 and related transitive updates.
package.json Adds a root resolutions override for webpack-dev-server to ensure patched versions are used.
e2e/react/yarn.lock Locks the React E2E app’s dependency graph after the dev-server bump.
e2e/react/package.json Bumps React E2E webpack-dev-server to ^5.2.4.
e2e/js/js-esm/package.json Bumps JS ESM E2E webpack-dev-server from v4 to ^5.2.4.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 8 changed files in this pull request and generated 1 comment.

Comment thread package.json Outdated
- uuid ^8.3.2 -> ^11.1.1 in package.json and sdk/js/package.json (runtime, alerts #1113/#1114)
- uuid resolution ^11.1.1 added to root and all e2e sub-project package.json files (alerts #1105-#1109)
- qs resolutions added for exact-pinned 6.13.0 and 6.14.0 -> ^6.15.2 in root (alerts #1110-#1112)
@jonathannorris
jonathannorris merged commit 36857ff into main Jun 1, 2026
14 checks passed
@jonathannorris
jonathannorris deleted the chore/dependabot-alerts branch June 1, 2026 13:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants