chore: clear all nineteen dependency advisories - #2
Conversation
npm audit reported nineteen advisories, one of them critical: node-tar could be driven into a decompression denial of service. The rest were DoS, ReDoS and path-traversal issues across the build and test toolchain — brace-expansion, minimatch, picomatch, js-yaml, flatted, postcss, nanoid, vite, esbuild, undici and others. Most of them cleared with a plain `npm audit fix`, which only takes semver-compatible upgrades. That left five, all inside the @vercel/node tree, where npm's only proposed fix was @vercel/node 3.0.1 — a downgrade from the 5.x currently in use, which is not a fix. @vercel/node is a devDependency used purely for types: the api handlers import VercelRequest and VercelResponse and nothing else, and Vercel supplies its own runtime in production, so none of that code ever runs. A scoped override lifts just those three packages inside that one subtree. ajv and path-to-regexp have patched releases within the major they already used; undici does not, so it moves to the 7.x line jsdom already pulls in, which keeps a single copy in the tree. npm audit now reports zero vulnerabilities. tsc -b, all 163 tests, eslint and the production build pass, and the built assets are byte-identical to before the change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
🟡 Changes recommended
The override upgrades undici to a version requiring Node >=20.18.1, but the repo doesn’t declare a supported Node engine range in package.json, which can lead to unexpected install failures for contributors on older Node versions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR addresses npm audit security advisories by upgrading semver-compatible dependencies and adding a scoped npm override to patch vulnerable transitive dependencies specifically within the @vercel/node dependency subtree.
Changes:
- Add an npm
overridesentry to pin patched versions ofundici,ajv, andpath-to-regexpunder@vercel/node. - Update
package-lock.jsonto reflect the audited dependency upgrades and override resolution, resulting in a vulnerability-free lockfile.
File summaries
| File | Description |
|---|---|
| package.json | Adds scoped overrides for @vercel/node transitive dependencies to eliminate remaining advisories. |
| package-lock.json | Captures the resolved upgraded dependency graph after npm audit fix + overrides. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| }, | ||
| "overrides": { |
What
npm auditreported 19 advisories onmain, one of them critical:server.fs.denybypassHow
Most cleared with a plain
npm audit fix— semver-compatible upgradesonly, no majors. That took 19 down to 5.
The remaining 5 were all inside the
@vercel/nodetree, where npm'sonly proposed fix was
@vercel/node@3.0.1— a downgrade from the 5.x inuse. That is not a fix, so it was not taken.
@vercel/nodeis a devDependency used purely for types: the handlers inapi/importVercelRequest/VercelResponseand nothing else, and Vercelsupplies its own runtime in production, so none of that package's code ever
executes. A scoped override lifts just three packages inside that one
subtree, leaving the rest of the dependency graph untouched:
ajv→^8.20.0— patched release within the major already in usepath-to-regexp→^6.3.0— same, patched within its majorundici→^7.29.0— no patched 5.x exists, so it joins the 7.x linejsdomalready pulls in, which also collapses the tree to a single copyVerification
npm audit— 0 vulnerabilities (was 1 critical + 13 high + 3 moderate + 2 low)tsc -b— clean, so theapi/type imports still resolvenpm test— 163/163 passingnpm run lint— cleannpm run build— passing, and the built assets are byte-identical to before the change (same content hashes), which is the direct evidence that nothing reached production output🤖 Generated with Claude Code