Repository navigation
Fix all open Dependabot alerts (pillow 13, next 15.5.28, vitest 4) - #1
Merged
Merged
Conversation
…d more) Backend (uv.lock, targeted upgrades only): pillow 13.0.0, starlette 1.9.0 via fastapi 0.159.1, python-multipart, urllib3, certifi, idna, mako, anyio, soupsieve, pydantic-settings, pygments, pytest, python-dotenv, virtualenv. Frontend: in-range updates via npm audit fix (next 15.5.28 and others), next-intl 4.9.2, vitest and coverage-v8 2 -> 4 with vite pinned to 7 (plugin-react 4 supports up to vite 7), and overrides for postcss under next, postcss-selector-parser 7 under tailwind 3, and picomatch 2.3.2. requestLocale is deprecated in next-intl 4.9+; the lint rule is suppressed on that line until a Next 16 migration.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
npm 10 (Node 20 in CI) rejected the npm 11 lockfile: next-intl's @swc/core wants @swc/helpers >=0.5.17 while next pins 0.5.15, so npm 10 needs a nested copy. Also takes virtualenv 21.14.13 for the HIGH CVE Trivy flags in 21.14.12 (dev-only, via pre-commit).
…ssion npm 10 (Node 20 in CI) rejected the npm 11 lockfile: next-intl's @swc/core wants @swc/helpers >=0.5.17 while next pins 0.5.15, so npm 10 needs a nested copy. next-intl 4.9.2 does not deprecate requestLocale (the earlier lint error came from a stale next lint cache), so the eslint-disable is removed and request.ts matches main.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all 197 open Dependabot alerts (checked by matching every open alert's vulnerable range against the new
uv.lockandpackage-lock.json: 0 left; same script on main: 197).Backend (
backend/uv.lock)Targeted
uv lock -Pupgrades only (no blanket upgrade): pillow 12.1.0 -> 13.0.0, fastapi 0.128.0 -> 0.159.1 (needed for starlette 0.50.0 -> 1.9.0), python-multipart 0.0.32, urllib3 2.8.0, certifi 2026.10.19, idna, mako, anyio, soupsieve, pydantic-settings, pygments, pytest, python-dotenv, virtualenv. Every new version is at least 3 days old (supply-chain cooldown), except virtualenv 21.14.13 (2.9 days): Trivy flags a HIGH CVE in 21.14.12 and 21.14.13 is the fix. Dev-only, via pre-commit.Frontend
npm audit fixin-range updates (next 15.5.9 -> 15.5.28, sharp, ws, rollup, lodash, js-yaml, ...), with--beforecooldown.vitepinned to ^7.3.7 as a dev dep so it dedupes to the version @vitejs/plugin-react 4 supports.overrides: postcss ^8.5.23 under next (next pins 8.4.31), postcss-selector-parser ^7.1.6 (tailwind 3 asks for 6.x), picomatch 2.3.2.Lockfile format
package-lock.jsonis written with npm 10 (CI runs Node 20). npm 11's lockfile failednpm cion npm 10 (Missing: @swc/helpers@0.5.23, an optional peer of next-intl's @swc/core).npm ci --dry-runnow passes on both npm 10 and npm 11.Verified locally
npm ci): lint, prettier, tsc,next buildall pass. Built CSS is byte-identical to the pre-override build (same content hash), so the selector-parser/postcss overrides change nothing.Pre-existing CI failures (same on main, not caused here)
test:coverage: the repo has no test files, so vitest exits 1 ("No test files found") on main's vitest 2 as well.