Repository navigation
Fix dependency vulnerabilities and guard build-time brace recursion - #24
Open
modhack2003 wants to merge 1 commit into
Open
modhack2003 wants to merge 1 commit into
modhack2003 wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Next.js and transitive dependencies produced 56 npm audit findings, including critical image-processing/framework advisories. Update Next.js to 15.5.28, Sharp to 0.35.5 and PostCSS to 8.5.30; align Prisma CLI/client at 6.19.3 and update the affected configuration, CSS, HTTP, YAML and test dependency chains. Remove unused patch-package and classify the Tailwind animation plugin as a build dependency. The production dependency audit drops from 18 findings to zero.
One upstream advisory remains: GHSA-vfj7-8cjw-p6xm has no patched braces release and currently produces 8 high development dependency-chain findings in GitHub CI (the recorded local audit reported 7). Apply a deterministic, hash-verified parser/AST nesting mitigation during installation and test it in CI. Raw npm audit counts and GitHub alerts remain visible; the audit gate accepts only this exact locally mitigated advisory and rejects new advisories, missing patches and invalid audit responses. See docs/dependency-security.md for the package-by-package changes, override compatibility checks and removal procedure.
Validation completed against this exact source tree:
Node.js 22+ is required, matching the existing CI setup. Cross-major transitive overrides are documented and covered by compatibility checks. No application UI, audio behavior, authentication flow or production data was changed.
PR verification: GitHub Checks run 38963553189 passed on Node.js 22.23.3 / npm 10.9.9, including the security gate, 372 unit tests, database integrations, production build and all 12 browser scenarios. Vercel preview is READY at https://bikram-dttc5fkl4-modhack2003s-projects.vercel.app; its homepage and public audio-settings API both returned HTTP 200. The PR remains open for review.