fix: address dependency vulnerabilities - #171
Merged
Merged
Conversation
- next: 15.5.23 -> 15.5.25 (docs, examples/01-console, examples/02-components, examples/03-tailwind). Patches two critical unauthenticated RCE advisories (GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4 / CVE-2026-75604) that affect the 15.x line below 15.5.24, not just the 16.x line pnpm's audit summary displayed. - sharp: pin pnpm override floor from >=0.35.0 to >=0.35.4, resolving to 0.35.4. Fixes a high-severity libheif RCE (GHSA-rgj7-g3m4-5g8c). - vitest: ^4.1.0 -> ^4.1.11 in package/package.json (devDependency, resolves to 4.1.11). Fixes a moderate dev-server path traversal / arbitrary file read via @vitest/mocker redirect mocks (GHSA-82fw-gwwq-j7x9). js-yaml was flagged by pnpm audit's summary (range 4.0.0-4.3.1) but the installed version (5.3.0, via the existing overrides) is not actually in either affected range per the GitHub advisory (only 3.x and 4.x lines are vulnerable) - left untouched as a false positive. Verified: pnpm build (package), pnpm build (docs), pnpm build (examples/02-components) all pass on the updated versions. pnpm audit now reports 0 actionable vulnerabilities (2 remaining highs were already suppressed pre-existing via auditConfig.ignoreCves, unrelated to this change).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
markbackman
approved these changes
Sep 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routine dependency vulnerability audit (
pnpm audit) turned up 3 real, fixable issues plus 1 false positive.nextsharpvitest(devDependency)Details
pnpm audit's summary only displayed the>=16.0.0 <16.3.3range, which made it look inapplicable to our pinned 15.5.23. Checked the GitHub Security Advisory API directly: both advisories also cover>=13.4.0 <15.5.24/>=10.0.0 <15.5.24, which does include our installed version. Bumped to 15.5.25 (stays on the 15.x line, no major upgrade) indocs,examples/01-console,examples/02-components,examples/03-tailwind.libheif(image optimization path). Tightened the existing pnpm override floor from>=0.35.0to>=0.35.4.@vitest/mockerredirect mocks. Only reachable if the local dev/test server is exposed offlocalhost; still worth patching. Bumpedpackage/package.jsondevDependency to^4.1.11(pnpm auto-raised the floor when resolving the update; no manual edit).pnpm auditflagged it (range4.0.0-4.3.1), but the installed resolution is5.3.0(via an existing override). Checked the advisory directly — it only covers the 3.x and 4.x lines, not 5.x. Left as-is; flagging here in case anyone else re-runs the audit and sees it.pnpm auditoutput but are unrelated to this PR — they're deliberately suppressed via the existingpnpm.auditConfig.ignoreCvesentry inpackage.json.Verification
pnpm audit— down from 3 actionable vulnerabilities (2 high, 1 critical) plus 1 newly-surfaced moderate (vitest) to 0 actionable (only the 2 pre-existing ignored CVEs remain).pnpm build(package) — passes.pnpm --filter @pipecat-ai/voice-ui-kit-docs build— passes (next buildon 15.5.25).pnpm --filter 02-components build— passes (next buildon 15.5.25). Noticed a pre-existingESLint: minimatch does not provide an export named 'default'warning during this build's lint step — reproduces identically onmain, unrelated to this change, not fixed here.Behavior changes
None externally observable. This is dependency-version-only; no API or config surface changed.