fix(frontend): close the npm audit gate — bump overrides to patched versions - #329
Merged
Conversation
…ersions Frontend CI has been failing check-audit for a while: two of the four existing overrides (fast-uri, brace-expansion) had drifted behind newer advisories, and two more (browserslist, nanoid) had none. - fast-uri: 3.1.4 -> 3.1.7 (fixes 4 SSRF/host-confusion advisories, ajv inherits the fix since it only depends on fast-uri) - brace-expansion: 5.0.8 -> 5.0.9 (fixes a DoS advisory; minimatch inherits the fix the same way) - browserslist: added override, 4.28.8 (fixes unbounded memory growth and a prototype-write crash) - nanoid: added override, 3.3.18 (fixes an infinite-loop DoS) All four picked as the minimal patch within their existing major line, not a jump to the latest major, to keep behavior change risk low. Verified: npm run check-audit -> "sin vulnerabilidades high/critical", npm run build, npm run test:run (161/161), npm run lint (0 errors, pre-existing warnings only) all pass clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F8ndA3fFsSkp8qw6sqeAva
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Owner
Author
|
"Indexer Node.js" salió en rojo, pero no es de este PR — esta rama se creó antes de que #328 (mi hotfix del bug de Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Descripción
Hotfix del "Frontend React" audit gate que ha estado en rojo en prácticamente todos los PRs del repo desde hace varios días. Confirmado con dos bumps consecutivos de dependabot (#313 y #323) que no lo resolvían — necesitaba el
overridesmanual que ya sugierescripts/check-audit.mjs.Causa raíz
package.jsonya tenía un bloqueoverrides, pero desactualizado: dos entradas (fast-uri,brace-expansion) quedaron pineadas a versiones que ya no cubren advisories nuevos, y dos vulnerabilidades más (browserslist,nanoid) no tenían override.fast-uriajvhereda el fix porque solo depende defast-uribrace-expansionminimatchhereda el fix igualbrowserslistnanoidTodas las versiones elegidas son el parche mínimo dentro de su misma línea mayor (no un salto a la última major), para minimizar riesgo de cambios de comportamiento.
Verificación
npm run check-audit→sin vulnerabilidades high/critical(antes: 4-6 high sin rastrear)npm run buildlimpionpm run test:run— 161/161 pasannpm run lint— 0 errores (solo warnings preexistentes, no relacionados)🤖 Generated with Claude Code
https://claude.ai/code/session_01F8ndA3fFsSkp8qw6sqeAva
Generated by Claude Code