fix(deps): resolve pnpm audit vulnerabilities (2026-07-22)#915
Draft
cursor[bot] wants to merge 1 commit into
Draft
fix(deps): resolve pnpm audit vulnerabilities (2026-07-22)#915cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
Upgrade next, eslint, sharp, and related dev dependencies to pull in patched transitive packages (brace-expansion, linkify-it, svgo). Refresh lockfile for minimatch/brace-expansion resolution. Postcss override remains required (Next pins postcss 8.4.31). Sharp via next optional dependency still requires override to fix. Co-authored-by: Arnau Gómez Farell <arnaugomez@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Scheduled
pnpm auditfound 7 high-severity vulnerabilities.pnpm audit fixdid not resolve any of them. This PR upgrades direct dependencies and refreshes the lockfile to pull in patched transitive packages.Verification:
pnpm install --frozen-lockfilepasses,pnpm run build:nextpasses.Overrides: The existing
postcss: "$postcss"override remains necessary (removing it exposes GHSA-qx2v-qp2m-jg93 vianext>postcss@8.4.31). No overrides were added.Vulnerability fixes
brace-expansioneslint>minimatch>brace-expansioneslint10.2.1 → 10.7.0; lockfile refresh updatedbrace-expansion5.0.6 → 5.0.7brace-expansioneslint-config-next>eslint-plugin-jsx-a11y>minimatch>brace-expansioneslint-config-next16.2.9 → 16.2.11; lockfile refresh updatedbrace-expansion1.1.13 → 1.1.16brace-expansioneslint-plugin-mdx>eslint-mdx>unified-engine>glob>minimatch>brace-expansioneslint-plugin-mdx^3.7.0 → ^3.8.1; lockfile refresh updatedbrace-expansion2.1.0 → 2.1.2linkify-it@tiptap/extension-focus>@tiptap/pm>prosemirror-markdown>markdown-it>linkify-itlinkify-it5.0.1 → 5.0.2 (semver range^5.0.1already allowed the patch;@tiptap/extension-focusalready at latest 2.27.2)svgo@svgr/webpack>@svgr/plugin-svgo>svgosvgo3.3.3 → 3.3.4 (@svgr/webpackalready at latest 8.1.0;svgorange^3.0.2allows the patch)sharpsharp^0.33.4 → ^0.35.3 (0.35.3 installed)sharpnext>sharp(optional)Package upgrades
next/@next/mdx: ^16.2.9 → ^16.2.11sharp: ^0.33.4 → ^0.35.3eslint: 10.2.1 → 10.7.0eslint-config-next: 16.2.9 → 16.2.11eslint-plugin-mdx: ^3.7.0 → ^3.8.1Unfixed vulnerabilities
sharp via Next.js optional dependency (GHSA-f88m-g3jw-g9cj)
Why not fixed: Next.js 16.2.11 (latest stable) declares
sharpas an optional dependency at^0.34.5, which resolves to0.34.5— below the patched>=0.35.0threshold. There is no parent dependency upgrade that forces Next to usesharp@0.35.x.How it could be fixed: Add a pnpm override to align Next's optional
sharpwith the direct dependency, e.g."sharp": "$sharp"inpnpm.overrides(the project already uses$postcssfor a similar purpose). Alternatively, wait for a Next.js release that bumps its optionalsharprange to>=0.35.0.Risk note: This is an optional dependency used for image optimization in production builds. The direct
sharpdependency is already patched.postcss via Next.js (GHSA-qx2v-qp2m-jg93) — mitigated by existing override
Status: Not a new finding; mitigated by the existing
postcss: "$postcss"override. Next 16.2.11 still pinspostcss@8.4.31in its dependencies. The override cannot be removed until Next bundlespostcss>=8.5.10.How it could be fixed without override: Wait for a Next.js release that updates its bundled PostCSS version.