chore: resolve open dependabot security alerts - #1422
Merged
Conversation
- @babel/core -> 7.29.7 (low, alert #225) - form-data -> 4.0.6 (high, alert #229) - markdown-it -> 14.3.0 (medium, alert #237) - http-proxy-middleware -> 2.0.10 (medium, alert #241) - js-yaml 4.x -> 4.3.0 via scoped resolutions (high, alerts #243, #250) - js-yaml 3.x (gray-matter) -> 3.15.0 via scoped resolution (medium, alerts #244, #249) - websocket-driver -> 0.7.5 (critical/medium, alerts #245, #246) - tar -> 7.5.22 (critical/high/medium, alerts #252, #253, #254, #255, #267) - body-parser -> 1.20.6 (low, alert #258) - linkify-it -> 5.0.2 (high, alert #259) - immutable -> 5.1.9 (high, alerts #260, #261) Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
✅ Deploy Preview for openfeature ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
jonathannorris
marked this pull request as draft
July 27, 2026 14:24
📝 WalkthroughWalkthrough
ChangesDependency and container setup updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR aims to reduce open Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies using Yarn resolutions, and updating yarn.lock to reflect the resulting dependency graph.
Changes:
- Added/updated Yarn
resolutionsto steer vulnerable transitive dependencies to patched versions (including scoped resolutions forjs-yamlconsumers). - Re-resolved dependencies and updated
yarn.lockto the new patched versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Adds/adjusts Yarn resolutions to force patched transitive dependency versions (including scoped overrides). |
| yarn.lock | Updates the lockfile to reflect the patched versions selected by the new resolutions. |
Comments suppressed due to low confidence (2)
package.json:154
- This resolution allows immutable 5.1.8, but the lockfile currently resolves 5.1.9 (the patched version referenced in the PR description). Consider bumping the minimum to ^5.1.9 so a future re-resolution can’t fall back to 5.1.8.
"immutable": "^5.1.8",
package.json:158
- This resolution range permits markdown-it 14.2.x, but the lockfile resolves 14.3.0 (the patched version referenced in the PR description). Setting the minimum to ^14.3.0 makes the security bump durable across future lockfile regenerations.
"markdown-it": "^14.2.0",
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
jonathannorris
marked this pull request as ready for review
July 27, 2026 17:06
jonathannorris
enabled auto-merge
July 27, 2026 17:06
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 173-174: Update the js-yaml override entry in package.json to use
the exact descriptor js-yaml@npm:4.1.0 so it matches markdownlint-cli2@0.17.2;
retain the existing caret-descriptor entry only if another dependency explicitly
requires it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9bcdccc7-f912-4383-a024-1809502851d6
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
package.json
Comment on lines
+173
to
+174
| "markdownlint-cli2/js-yaml": "^4.3.0", | ||
| "js-yaml@npm:^4.1.0": "^4.3.0", |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
yarn install --immutable
yarn why js-yaml
rg -n -A8 -B2 '^"markdownlint-cli2@|^"js-yaml@npm:' yarn.lockRepository: open-feature/openfeature.dev
Length of output: 637
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== packageManager and overrides lines =="
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log('packageManager:', pkg.packageManager);
console.log('overrides:', pkg.resolutions || pkg.overrides || null);
const text = fs.readFileSync('package.json','utf8').split('\n');
for (let i=Math.max(0, 168); i<Math.min(text.length, 180); i++) {
console.log(`${i+1}: ${text[i]}`);
}
JS
echo
echo "== lockfile descriptor sections =="
rg -n -A12 -B1 '^(| "\[workspace-root\]"\]| \[".*"\]| \["[^"]+ js-yaml@npm| \["[^"]+ markdownlint-cli2@)"' yarn.lock || true
echo
echo "== git status around lock =="
git diff --stat package.json yarn.lock || true
git diff -- package.json yarn.lock | sed -n '1,240p' || trueRepository: open-feature/openfeature.dev
Length of output: 50385
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== packageManager and relevant override keys =="
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(pkg.packageManager);
for (const key of pkg.resolutions || pkg.overrides || {}) console.log(`${key} => ${pkg.resolutions[item] ?? pkg.overrides[item]}`);
const text = fs.readFileSync('package.json','utf8').split('\n');
for (let i=Math.max(0, 168); i<Math.min(text.length, 180); i++) console.log(`${i+1}: ${text[i]}`);
JS
echo
echo "== exact js-yaml lockfile descriptor header =="
grep -n -n '^"js-yaml@npm:4.1.0":$\|^"js-yaml@npm:^4.1.0":$\|^"js-yaml@npm:4.1.0,\|^"js-yaml@npm:^4.1.0,' yarn.lock || true
sed -n '/^"js-yaml@npm:/,/^$/p' yarn.lock | head -200
echo
echo "== markdownlint-cli2 lockfile descriptor header =="
sed -n '/^"markdownlint-cli2@npm:4.1.0":$/,/^$/p' yarn.lock | head -120
echo
echo "== package.json and yarn.lock references =="
python3 - <<'PY'
from pathlib import Path
pkg = Path('package.json').read_text().splitlines()
for i,l in enumerate(pkg,1):
if 'markdownlint-cli2/js-yaml' in l or '"js-yaml@npm:^4.1.0"' in l:
print(f'package.json:{i}: {l}')
text = Path('yarn.lock').read_text()
for key in ('js-yaml@npm:4.1.0', 'js-yaml@npm:^4.1.0', 'markdownlint-cli2@npm:'):
print(f'-- {key} matches --')
for i,l in enumerate(text.splitlines(),1):
if key in l:
print(f'yarn.lock:{i}: {l}')
PYRepository: open-feature/openfeature.dev
Length of output: 1135
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== packageManager and relevant override keys =="
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(pkg.packageManager);
for (const [key, value] of Object.entries(pkg.resolutions || pkg.overrides || {})) {
console.log(`${key} => ${value}`);
}
const text = fs.readFileSync('package.json','utf8').split('\n');
for (let i=Math.max(0, 168); i<Math.min(text.length, 180); i++) console.log(`${i+1}: ${text[i]}`);
JS
echo
echo "== exact js-yaml lockfile descriptor header =="
grep -n '^"js-yaml@npm:4.1.0":$\|^"js-yaml@npm:^4.1.0":$\|^"js-yaml@npm:4.1.0,\|^"js-yaml@npm:^4.1.0,' yarn.lock || true
sed -n '/^"js-yaml@npm:/,/^$/p' yarn.lock | head -200
echo
echo "== markdownlint-cli2 lockfile descriptor header =="
sed -n '/^"markdownlint-cli2@npm:4.1.0":$/,/^$/p' yarn.lock | head -120
echo
echo "== package.json and yarn.lock references =="
python3 - <<'PY'
from pathlib import Path
lines = Path('package.json').read_text().splitlines()
for i, l in enumerate(lines, 1):
if 'markdownlint-cli2/js-yaml' in l or '"js-yaml@npm:^4.1.0"' in l:
print(f'package.json:{i}: {l}')
text = Path('yarn.lock').read_text()
for key in ('js-yaml@npm:4.1.0', 'js-yaml@npm:^4.1.0', 'markdownlint-cli2@npm:'):
print(f'-- matches for literal {key!r} --')
for i, l in enumerate(text.splitlines(), 1):
if key in l:
print(f'yarn.lock:{i}: {l}')
PYRepository: open-feature/openfeature.dev
Length of output: 2980
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== package managers =="
command -v yarnpkg || true
corepack --version || true
corepack enable --install-directory ~/.local/bin 2>/tmp/corepack-enable.log || { cat /tmp/corepack-enable.log; exit 0; }
corepack use yarn@4.12.0 || true
yarnpkg --version || true
echo
echo "== yarn why with yarnpkg =="
yarnpkg why js-yaml || true
echo
echo "== yarn.lock markdownlint and js-yaml excerpt =="
sed -n '12330,12360p' yarn.lock
sed -n '12360,12395p' yarn.lock
echo
echo "== lockfile package descriptor context for caret js-yaml =="
rg -n -A12 -B2 'js-yaml@npm:\^4.1.0|js-yaml@npm:\^\^4.3.0|# js-yaml@npm:\^4.1.0' yarn.lock || true
echo
echo "== package scripts/config =="
python3 - <<'PY'
from pathlib import Path
pkg = __import__('json').loads(Path('package.json').read_text())
for k in ('packageManager','resolutions','scripts','dependencies','devDependencies'):
if k in pkg:
v = pkg[k]
if k in ('dependencies','devDependencies'):
v = {key: value for key, value in v.items() if 'markdownlint' in key or 'markdownit' in key or k in (value if isinstance(value,str) else value)}
print(f'--- {k} ---')
print(__import__('json').dumps(v, indent=2, sort_keys=True)[:5000])
PYRepository: open-feature/openfeature.dev
Length of output: 1100
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== lockfile markdownlint and js-yaml excerpt =="
sed -n '12330,12355p' yarn.lock
sed -n '12360,12395p' yarn.lock
echo
echo "== yarn.lock caret js-yaml descriptor context =="
rg -n -A12 -B2 'js-yaml@npm:\^4\.1\.0|js-yaml@npm:4\.1\.0|js-yaml@npm:\^4\.3\.0|# js-yaml@npm:\^4\.1\.0' yarn.lock || true
echo
echo "== package metadata relevant sections =="
python3 - <<'PY'
from pathlib import Path
import json
pkg = json.loads(Path('package.json').read_text())
for k in ('packageManager','scripts','dependencies','devDependencies'):
if k in pkg:
print(f'--- {k} ---')
value = pkg[k]
if k in ('dependencies','devDependencies'):
value = {key: value for key, value in value.items() if 'markdownlint' in key.lower() or 'markdownit' in key.lower() or k in (value if isinstance(value,str) else value)}
print(json.dumps({k: value}, indent=2, sort_keys=True)[:5000])
PYRepository: open-feature/openfeature.dev
Length of output: 4091
Use the exact markdownlint js-yaml descriptor.
markdownlint-cli2@0.17.2 resolves js-yaml@npm:4.1.0, so the targeted override should be js-yaml@npm:4.1.0. The current js-yaml@npm:^4.1.0 descriptor targets a different package descriptor and may not apply. Keep the existing entry only if another dependency requires the exact caret descriptor.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 173 - 174, Update the js-yaml override entry in
package.json to use the exact descriptor js-yaml@npm:4.1.0 so it matches
markdownlint-cli2@0.17.2; retain the existing caret-descriptor entry only if
another dependency explicitly requires it.
Signed-off-by: Todd Baert <todd.baert@dynatrace.com>
toddbaert
approved these changes
Jul 30, 2026
toddbaert
left a comment
toddbaert
left a comment
Member
There was a problem hiding this comment.
Added one small change to fix local dev.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@makefile`:
- Around line 8-9: Update the SETUP command to configure Git safe.directory with
the resolved mounted checkout path instead of the wildcard '*'. Preserve
corepack enable and Git’s ownership protection for all unrelated repositories.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Comment on lines
+8
to
+9
| # container runs as root while repo is owned by host user; allow git to run here | ||
| SETUP := git config --global --add safe.directory '*' && corepack enable |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scope Git trust to the mounted checkout
safe.directory '*' disables Git’s dubious-ownership protection for every repository path in the container, although this setup only needs to trust the host-mounted checkout. Use the checkout’s resolved path instead, preserving the ownership check for unrelated or attacker-controlled repositories.
Proposed fix
-SETUP := git config --global --add safe.directory '*' && corepack enable
+SETUP := git config --global --add safe.directory \"$$(pwd)\" && corepack enable🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@makefile` around lines 8 - 9, Update the SETUP command to configure Git
safe.directory with the resolved mounted checkout path instead of the wildcard
'*'. Preserve corepack enable and Git’s ownership protection for all unrelated
repositories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolved 20 of 22 open Dependabot security alerts by bumping vulnerable transitive dependencies via scoped Yarn resolutions (lockfile-only re-resolution where the parent's range already permitted the patched version; scoped
resolutionswhere it did not).Dependabot Alerts Resolved
@babel/core^7.29.6form-data^4.0.6markdown-it^14.2.0http-proxy-middleware^2.0.10js-yaml(4.x line)markdownlint-cli2/js-yamlandjs-yaml@npm:^4.1.0js-yaml(3.x line, gray-matter)gray-matter/js-yamlwebsocket-driver^0.7.5tar^7.5.22body-parser^1.20.6linkify-it^5.0.2immutable^5.1.8Notes
js-yaml3.x resolution is scoped togray-matter/js-yaml(not global).gray-matter@4.0.3depends onjs-yaml@^3.13.1and calls thesafeLoadAPI removed in js-yaml 4; a global bump would break Docusaurus frontmatter parsing at build time.js-yaml4.x resolutions target bothmarkdownlint-cli2/js-yaml(which pins an exact4.1.0) and the generaljs-yaml@npm:^4.1.0range (docusaurus, eslint, redocly, cosmiconfig) so both consumers land on the patched 4.3.0.Unresolvable / Deferred
tsup(low): no patched version is available yet (first_patched_versionis null). Left open.brace-expansion(high): the only patched line is5.0.8, which is a full rewrite that dropped the CommonJS default export. Bothwireit(our build/lint task runner,import braces from 'brace-expansion') andminimatch@9.x(used internally by tooling) rely on that default export, so forcing this resolution breaksyarn lint:md/yarn buildimmediately (SyntaxError: The requested module 'brace-expansion' does not provide an export named 'default'). Fixing this cleanly requires upgrading theminimatch/glob/wireittoolchain to versions compatible with the new brace-expansion API, which is out of scope for a dependency-only security patch. Left unresolved pending a compatible patch release or a separate toolchain upgrade.Verification
yarn install: lockfile resolves cleanly, all listed packages land on patched (or newer same-major) versions.yarn build(full Docusaurus production build): succeeds.yarn lint:md(markdownlint-cli2, the js-yaml/markdown-it consumer): 0 errors.yarn lint:es: passes on a clean checkout (verified separately; the nested-worktree checkout used for this change hits an unrelated ESLint plugin-resolution quirk from having twonode_modulestrees stacked on top of each other, not present in CI).yarn typecheckerrors (missing image type declarations, aC++dataset entry, and an Algolia type mismatch) are unrelated to these changes and reproduce identically on a cleanorigin/main.