chore(deps): resolve remaining Dependabot alerts (round 2)#14
Conversation
Bump transitive packages to patched versions via yarn resolutions: - http-proxy-middleware 2.0.7 -> 2.0.9 (CVEs in lockfile copy) - loader-utils 2.0.3 -> 2.0.4 - bn.js ^4.0.0 (asn1.js) -> 4.12.3 (scoped; leaves bn.js 5.x intact) - semver 5.7.1 (read-pkg/normalize-package-data) -> 5.7.2 (scoped; leaves 6.x/7.x intact) All affected packages are dev/build tooling, not in published dist. Behavior-preserving: no source changes. Co-authored-by: Cursor <cursoragent@cursor.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughPins several transitive dependencies in package.json resolutions and updates src/index.ts to call createProxyMiddleware with a single merged options object, setting pathFilter from proxyEntry.context. ChangesResolutions and proxy adapter
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 45: package.json currently lists two conflicting entries for
http-proxy-middleware (a resolutions pin "http-proxy-middleware": "2.0.9" and a
direct dependency "http-proxy-middleware": "^3.0.5") which causes both 2.0.9 and
3.0.5 to be installed; fix by either removing the resolutions entry if you
actually need the direct ^3.0.5, or by changing the direct dependency
"http-proxy-middleware" (the package.json key) to the exact version "2.0.9" so
the resolution and the direct dep match and only one version is installed, then
run yarn install and verify with yarn why http-proxy-middleware and inspecting
yarn.lock that only 2.0.9 remains; also investigate why the 2.0.9 pin was
originally added (search commit/PR notes or run yarn why to find which package
required 2.x) and document/remove the pin if it’s unnecessary.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 45ca9dc0-15bf-4360-a234-68f7fc802a09
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
package.json
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 5 file(s) based on 1 unresolved review comment. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 5 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/index.ts (1)
1-44:⚠️ Potential issue | 🟡 MinorFix PR description inconsistency (http-proxy-middleware version + source-change scope)
yarn.lockresolveshttp-proxy-middlewareto v3.0.5 (http-proxy-middleware@^3.0.5→version "3.0.5"); there are nohttp-proxy-middlewarev2.x entries. The2.0.7/2.0.9versions that appear inyarn.lockbelong to other packages (e.g.,conventional-changelog-*,proxy-addr), nothttp-proxy-middleware.Meanwhile,
src/index.tsincludes v3-style usage (createProxyMiddleware(middlewareOptions)andpathFilterpassed via options), so the PR objective of “no source code changes; only lockfile/manifest edits” and the statedhttp-proxy-middlewarebump 2.0.7 → 2.0.9 don’t match what’s present in the repo—please update the PR description (or document the actual dependency that was bumped and why source changes were required).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/index.ts` around lines 1 - 44, The PR description is inconsistent with the code: src/index.ts already uses http-proxy-middleware v3 APIs (createProxyMiddleware and pathFilter in middleware options) while the PR text claims a 2.0.7→2.0.9 bump and “no source changes”; update the PR description to accurately state which package and version were changed (or that yarn.lock already resolved http-proxy-middleware@3.0.5), note that source changes were required to use v3-style API (refer to createProxyMiddleware, pathFilter, proxyModule and getProxyEntries/HttpProxyOptions), and clarify why the lockfile/manifest edits and code adjustments were made so the PR message matches the actual changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/index.ts`:
- Around line 30-34: PR description incorrectly claims a v2 API change and a
2.0.7→2.0.9 patch bump with no source changes; update the PR summary to reflect
that this repo uses http-proxy-middleware v3 (see package.json/yarn.lock) and
that src/index.ts intentionally uses the v3 pattern
createProxyMiddleware(middlewareOptions) with pathFilter set from
proxyEntry.context (see middlewareOptions, pathFilter, proxyEntry.context,
createProxyMiddleware). Remove the incorrect statement about
v2/legacyCreateProxyMiddleware and adjust the changelog/PR title to describe the
actual change: wiring context → pathFilter in v3 rather than a no-op patch bump.
---
Outside diff comments:
In `@src/index.ts`:
- Around line 1-44: The PR description is inconsistent with the code:
src/index.ts already uses http-proxy-middleware v3 APIs (createProxyMiddleware
and pathFilter in middleware options) while the PR text claims a 2.0.7→2.0.9
bump and “no source changes”; update the PR description to accurately state
which package and version were changed (or that yarn.lock already resolved
http-proxy-middleware@3.0.5), note that source changes were required to use
v3-style API (refer to createProxyMiddleware, pathFilter, proxyModule and
getProxyEntries/HttpProxyOptions), and clarify why the lockfile/manifest edits
and code adjustments were made so the PR message matches the actual changes.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f11aff0c-385b-44b4-843f-bd24aaceafe2
⛔ Files ignored due to path filters (3)
dist/index.d.tsis excluded by!**/dist/**dist/index.jsis excluded by!**/dist/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
package.jsonsrc/index.ts
💤 Files with no reviewable changes (1)
- package.json
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 1 file(s) based on 1 unresolved review comment. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 1 file(s) based on 1 unresolved review comment. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
1 participant
Summary
Follow-up to the merged
cursor/2026-06-06-dependabot-patchinground. Resolves the remaining actionable Dependabot alerts by bumping transitive packages to their patched versions via yarnresolutions. No source code changes — purely lockfile/manifest, behavior-preserving. All affected packages are dev/build tooling and are not part of the publisheddist/.Alert → resolution
http-proxy-middlewareloader-utilsbn.jsasn1.js@^4.0.0)**/asn1.js/bn.jssemverread-pkg → normalize-package-data@2)**/read-pkg/normalize-package-data/semverWhy scoped resolutions for
bn.jsandsemverA blanket
bn.js/semverresolution would force unrelated majors down and break consumers:bn.js@^5.2.1(browserify-rsa/-sign) must stay on 5.2.3 — left untouched.semver@^6(6.3.1) andsemver@^7(7.8.2) consumers must stay on their majors — left untouched.Only the specific vulnerable instances are pinned via path-scoped globs. Verified in
yarn.lockthat 6.x/7.x semver and bn.js 5.x are unchanged.Residual alerts (no upstream fix available)
ip1.1.9, latest). Dev/build tooling only, not indist.parse-git-config3.0.0). Build tooling (standard-version), not indist.elliptic6.6.1, latest). Build polyfill, not indist.request2.88.2). Transitive dev tooling, not indist.These cannot be remediated until upstream ships fixes; they are confined to dev/build dependencies and never shipped to consumers.
Compatibility analysis
http-proxy-middleware2.0.7 → 2.0.9 is a patch within 2.0.x; the proxy API (createProxyMiddleware,Options) is unchanged. Note the 2.0.x copy exists only to satisfy the lockfile (the module's owndependenciesusehttp-proxy-middleware@^3.0.5), so this bump has zero runtime impact on the published module.loader-utils,bn.js,semverbumps are patch-level within their respective majors — API compatible.Test plan / verification (vs untouched
origin/master)yarn install— clean, lockfile saved.yarn lint— passes.yarn build— pre-existing TS failure insrc/index.ts(createProxyMiddlewareis called with the v2 two-arg signature while the directhttp-proxy-middleware@^3.0.5dep exposes the v3 single-arg types). Reproduces identically on base — not introduced by this PR. Theindex.jsartifact still emits; only the.d.tsstep exits 1.yarn jest— fails withCannot find module '@babel/plugin-transform-runtime'(required by the@nuxt/test-utilsjest preset but absent from the committed lockfile). Reproduces byte-for-byte on base — pre-existing environment issue, not introduced by this PR.Both pre-existing failures are unrelated to dependency security and out of scope for this round per the minimal/behavior-preserving constraint.
Made with Cursor
Summary by CodeRabbit