Dependency updates: every advisory outside fchub-stream - #108
Merged
Conversation
fast-uri 3.1.4 -> 3.1.5 (CVE-2026-18446, host confusion via backslash authority introducer) and hono 4.12.32 -> 4.12.34 (CVE-2026-69207, ReDoS in the CORS middleware), both through the existing overrides. biome 2.5.5 -> 2.5.7 alongside. qs, ip-address and express-rate-limit were already ahead of what Dependabot asked for. TypeScript 5.9 -> 7.0 and @types/node 24 -> 26 were left alone; a security bump is no place for a compiler major. 2823 unit, 225 acceptance, 22 conformance runs, 194 routes. npm audit clean with and without dev.
vite 6.4.1 -> 8.2.1 with @vitejs/plugin-vue 5.2.4 -> 6.0.8, which drags postcss, picomatch, brace-expansion and yaml up with it; esbuild becomes an explicit devDependency because vite 8 no longer bundles it. php_codesniffer 3.13.5 -> 3.13.6 for CVE-2026-67434. The vite major carries no enqueue risk, for an uncomfortable reason: Assets.php loads assets/js/fchub-thank-you-admin.js, a hand-written file with no build step, and no PHP anywhere references assets/dist. The Vue app that produced ten of this repository's twenty advisories is wired to nothing. npm audit 5 -> 0. phpunit 23/23, phpcs clean. Pre-existing typecheck and biome failures confirmed identical on the old tree; not this change.
vite 5.4.21 -> 8.2.1, @vitejs/plugin-vue 5.2.4 -> 6.0.8, esbuild 0.21.5 -> 0.28.1 as an explicit devDependency. npm audit 2 -> 0. The rebuild changes every content hash, so the committed bundle churns. Safe here because AdminMenu.php resolves entries through assets/dist/.vite/manifest.json at runtime rather than hardcoding hashed names — verified the emitted manifest still has the shape the PHP reads, including the style.css pseudo-entry fallback, and that both files exist on disk.
Element Plus 2.13.5 -> 2.14.3, Vue 3.5.30 -> 3.5.40, tiptap 3.28 -> 3.29.2, vue-router 5.0.3 -> 5.2.0, lucide 1.25 -> 1.28, plus the dev group: vitest 3.2.7 -> 4.1.10, jsdom 26 -> 30, playwright 1.55 -> 1.62, vite 8.0.16 -> 8.2.0. phpunit 13.0.5 -> 13.3.0. The lockfile needed regenerating from scratch — an in-place install hit an ERESOLVE between @tiptap/extension-link and starter-kit's pinned peer. js-cookie needed nothing: the existing override already sits at 3.0.8, above what Dependabot asked for. 349 vitest, 1883 phpunit / 11978 assertions, build clean, audit clean. Bundle hashes churn because the Vue and Vite bumps change them.
checkout v4 -> v7, setup-node v4 -> v7, upload-artifact v4 -> v7, download-artifact v4 -> v8, cache v4 -> v6, docker/login-action 4.5.2 -> 4.6.0, across nine workflows. Five majors, so every changed callsite's inputs were read rather than assumed: upload-artifact passes only name/path/if-no-files-found/ retention-days; download-artifact only name/path/run-id/github-token, no reliance on the removed merge-multiple model; cache only path/key; checkout fetch-depth and one sparse-checkout; setup-node node-version and cache. All nine still parse. Untested until a PR runs them — ci.yml triggers on pull_request only.
vue 3.5.30 -> 3.5.41, vite 8.0.16 -> 8.2.1, @vitejs/plugin-vue 6.0.5 -> 6.0.8. All inside existing caret ranges, so package.json is unchanged. 176 vitest, 612 phpunit. Deliberately no version bump and no touch to versions.json — 1.3.0 was tagged from a branch that is not merged yet.
next 16.2.11 -> 16.3.0, postcss 8.5.8 -> 8.5.26, fumadocs-mdx 14.2.9 -> 15.2.2, fumadocs-core 16.6.10 -> 16.14.1, vite 7.3.1 -> 8.2.1, @types/node 25 -> 26, typescript 5.9.3 -> 7.0.2. fumadocs-mdx 15 was rejected once on a peer mismatch, then retried after fumadocs-core moved and installed clean — that one bump closes js-yaml and picomatch, five findings. TypeScript across two majors passes build, lint and a raw tsc --noEmit; nothing here exercises the TS 7 changes. Three majors reverted because they need source changes, not a lockfile: lucide-react 1.x drops the Github and Twitter icons two pages import, react-day-picker 10 reshapes ClassNames, recharts 3 breaks nine types in chart.tsx. Those belong in their own change. Of the 8 left, 4 are a postcss pinned exactly at 8.5.23 inside next's own published package.json — not reachable from our lockfile, and 16.3.0 is the newest stable. 223/223 pages build, biome clean, catalogue in sync.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The workflow contract tests pin action majors on purpose, and they did exactly their job: bumping download-artifact to v8 broke assertions still expecting v4. Updated all eight pins to match — checkout v7, setup-node v7, upload-artifact v7, download-artifact v8, cache v6. 30/30 contract tests pass. jsdom goes back to 26.1.0. Thirty starts no forks worker on CI's Node 24 — undici's CacheStorage throws inside jsdom/lib/api.js and all 47 test files fail to launch. It passed locally on Node 26, which is the whole argument for opening the pull request before trusting a green local run. No advisory drove that bump, so reverting costs nothing. 349 tests pass again.
Node pins were a museum: 20, 22, 24 and an exact 24.13.0 scattered across ten workflows. All now 26, and the two exact pins 26.7.0. Nothing old kept. That reverses yesterday's jsdom decision, correctly. Thirty failed on CI Node 24 — undici's CacheStorage threw and no forks worker started — and the engines range was never the problem, since '24' resolves to 24.19.0, above its ^24.15.0 floor. It was a real Node 24 incompatibility. On 26 it passes: 349 tests. @modelcontextprotocol/conformance 0.2.0-alpha.10 -> alpha.11, which is what sdk-current was failing on. It exists to catch exactly the pin a previous pass declined to move. 2823 unit tests, 22 conformance runs, zero failures. fluentcart-mcp still declares engines >=24.0.0 — the published package supports Node 24, but nothing now tests that floor.
The Node bump broke something the sed could not see. mcp-promote and mcp-release do not merely set up Node — they assert the toolchain at runtime, test node --version and npm --version, because the publishing path carries provenance and a surprise interpreter is exactly what that control exists to stop. Changing the setup-node pin alone would have left those assertions demanding v24.13.0 and failed at release time, which is the worst possible moment to find out. So all of it moves together: setup-node 26.7.0, the runtime assertions to v26.7.0, and npm to 11.19.0 — the version Node 26.7.0 actually ships, checked against the Node dist index rather than assumed. mcp-release installs its publishing CLI explicitly, so that pin moved from 11.15.0 to 11.19.0 too. Four contract tests pinned the old values and now pin the new ones. Between them and the workflow contracts they caught every stale pin in this sweep, which is a good argument for their existence. npm 12.0.2 is out and deliberately not taken. It is a major on the Trusted Publishing path, where npm publish --provenance semantics live. That wants its own change and a real release to prove it. 30/30 workflow contracts, 404/405 tooling — the one failure is the stale gitignored dist-packages fixture from 31 July, absent in CI.
The contract pins a source-tree digest, so bumping conformance to alpha.11 staled it and the package gate refused the branch. Two lines move: the conformance version and the digest. Tool and category counts are untouched at 291 and 20, so versions.json still agrees with it — checked, not assumed. A previous pass left this alone on the grounds that it is release tooling. It is, but the gate runs on every pull request precisely so a dependency change cannot reach a tag with a contract that describes a different tree.
The manifest embeds the same source-tree digest the contract measures, and a test exists solely to tie the two together — so regenerating one without the other is a desync the gate catches, which it did. Manifest regenerated: same two lines, digest and conformance version, still 25 advertised tools at v2.2.0. One release-truth expectation moved to alpha.11 with it. The registry fixtures under tests/fixtures/sdk keep saying alpha.10 on purpose: they are a synthetic registry that exercises the selection logic, and editing them to agree with reality would delete the thing they test.
Version Consistency has been red on main since the commit that added GET /admin/fc-space-groups, which registered the route and updated neither the reference table nor the count the checker pins. Both halves now close: the table gains a row saying what the endpoint does and that it returns an empty list when FluentCommunity is inactive — read off DynamicOptionsController::fcSpaceGroups rather than guessed — and the registered-route count moves 99 to 100. Unrelated to the dependency work; fixed here because it was the only remaining red check and it was never this branch's doing.
This was referenced Aug 7, 2026
This was referenced Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every open advisory outside
fchub-streamis now closed. Seven commits, one workspace each, so a bad bump can be reverted without taking the rest down with it.fluentcart-mcpfchub-thank-youfchub-portal-extenderfchub-membershipscartshiftweb-docsThe uncomfortable part
Ten of the twenty advisories came from
plugins/fchub-thank-you/admin— a Vue and Vite build whose output nothing loads.Assets.php:11enqueuesassets/js/fchub-thank-you-admin.js, a hand-written file with no build step, and no PHP anywhere referencesassets/dist. Zero dist files are tracked.So half the repository's security surface was a pipeline with no consumer. The bumps here are real and the advisories are genuinely closed, but deleting that app would have closed more of them than this PR does.
What I did not take
Three
web-docsmajors need source changes, not a lockfile, and a security sweep is the wrong place to make them:GithubandTwittericons thatcontact/page.tsxandlayout.shared.tsximportClassNames;calendar.tsxfails typecheckchart.tsxvia the Tooltip and Legend prop changesThey stay on the old majors, which is why
lodashis still listed againstrecharts.fumadocs-mdx15 was rejected once on a peer mismatch and retried afterfumadocs-coremoved — it installed clean the second time and tookjs-yamlandpicomatchwith it. Worth the second look.TypeScript went 5.9 to 7.0. I expected that to fail and it did not: build, lint, catalogue check and a bare
tsc --noEmitall pass. Nothing in here exercises the TS 7 changes.Of the eight left in web-docs
Four are a
postcsspinned exactly at8.5.23inside Next's own publishedpackage.json, line 88. No override in this project can reach it and 16.3.0 is the newest stable, so it clears when Next ships a patch and not before. One is a danglingesbuild@0.27.3from aviteoptional peer that refuses to dedupe against the0.28.1already present — dead weight, nothing invokes it. The rest trace back to the two reverted majors.Actions
Five majors across nine workflows:
checkoutv4→v7,setup-nodev4→v7,upload-artifactv4→v7,download-artifactv4→v8,cachev4→v6. Every changed callsite's inputs were read rather than assumed — no reliance on the removedmerge-multiplemodel, norestore-keys, nothing that moved.This PR is the first thing that actually runs them.
ci.ymltriggers onpull_request, so nothing before now has exercised these pins. If a release workflow was going to break, it breaks here rather than at the next tag, which is the entire reason to look at the checks before merging.Deliberately not in this branch
cartshift's rebuilt bundle. The new Vite emits fresh content hashes across ~140 files, andcartshift/1.3.0-selective-migrationis unmerged with its own bundle built against the old one. Committing it here buys a merge conflict and nothing else; the bundle is rebuilt at release anyway.fchub-stream, entirely. It is discontinued. Its fourteen Dependabot pull requests are closed and its three advisories remain open, which is a decision to be made on the security tab rather than in a diff.