chore(deps): resolve all Dependabot security alerts (dev deps)#187
Merged
Conversation
Resolve all 6 open Dependabot alerts, all in development scope: - uuid ^10.0.0 -> ^11.1.1 (devDependency) — missing buffer bounds check in v3/v5/v6 (#46, #45) - fast-uri 3.0.6 -> 3.1.2 via resolutions — host confusion and path traversal via percent-encoded sequences (#42, #41) - picomatch 2.3.1 -> 2.3.2 via resolutions — method injection in POSIX character classes (#36) - @tootallnate/once 2.0.0 -> 2.0.1 via resolutions — incorrect control flow scoping (#43) Transitive deps are pinned via the existing `resolutions` block since Yarn 1's `upgrade` doesn't bump transitive-only packages. All changes are dev-scoped; `yarn build` and the full test suite (363 tests) pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Both were only ever used by the examples/ directory, which was deleted in #149 (commit 4b7760c, 2025-08-04), leaving them orphaned and unused for ~10 months. The current tree has zero imports of uuid. Removing them drops two packages from the dependency tree (and their future Dependabot alerts) and supersedes the uuid 10->11 bump as the fix for the uuid buffer-bounds alerts (#45/#46). The fast-uri, picomatch, and @tootallnate/once resolutions are unaffected (pulled via jest/ webpack/msw, not uuid). yarn build and the full test suite (363) pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all 6 open Dependabot alerts, all in development scope (
devDependenciesand their transitive deps), touching onlypackage.jsonandyarn.lock.Removes the unused
uuidand@types/uuiddevDependencies entirely — git history shows they were only ever used by theexamples/directory, which was deleted in #149 (commit4b7760c, Aug 2025), so they've been orphaned/unused for ~10 months. This clears the uuid alerts (#46/#45) by removal and drops two packages from future Dependabot maintenance. Separately, pins three transitive dev deps via the existingresolutionsblock to clear their alerts:fast-uri 3.0.6 → 3.1.2(host confusion + path traversal, #42/#41),picomatch 2.3.1 → 2.3.2(POSIX char-class method injection, #36), and@tootallnate/once 2.0.0 → 2.0.1(incorrect control-flow scoping, #43). All changes are dev-scoped and never ship to SDK consumers;yarn buildand the full 363-test suite both pass.🤖 Generated with Claude Code