security: resolve npm Dependabot alerts, add npm ecosystem to Dependabot#399
Conversation
…ndabot config npm audit fix (all semver-compatible, devDependencies only): - webpack-dev-server 5.2.2 -> 5.2.4 (GHSA-79cf-xcqc-c78w) - shell-quote 1.8.1 -> 1.8.4 (GHSA-w7jw-789q-3m8p, critical) - qs 6.14.2 -> 6.15.2 (GHSA-q8mj-m7cp-5q26) - ws 8.18.0 -> 8.21.0 (GHSA-58qx-3vcg-4xpx) The uuid alert (GHSA-w5hq-g745-h8pq) is dismissed rather than patched: sockjs pins uuid@^8 and only calls uuid.v4(); the advisory affects v3/v5/v6 with a caller-provided buf, so the vulnerable code is unused. Also adds an npm package-ecosystem entry to dependabot.yml (monthly, grouped) so future npm advisories get automatic fix PRs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR addresses Dependabot/npm audit security findings by updating transitive npm devDependency packages (primarily under webpack-dev-server) and adds Dependabot coverage for the npm ecosystem so future npm updates are automated.
Changes:
- Updated
package-lock.jsonto pick up patched transitive dependency versions (e.g.,webpack-dev-server,shell-quote,qs,ws). - Documented the dependency/security maintenance work in the changelog under Unreleased → CI.
- Expanded
.github/dependabot.ymlto include monthly npm version updates, grouped into a single PR.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
package-lock.json |
Lockfile-only updates to pull in patched transitive npm dev/build-time dependencies. |
CHANGELOG.md |
Notes the Dependabot/npm audit remediation and new npm Dependabot coverage under Unreleased CI. |
.github/dependabot.yml |
Adds npm ecosystem updates (monthly) with grouping to reduce PR noise. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #399 +/- ##
=======================================
Coverage ? 47.75%
=======================================
Files ? 2
Lines ? 423
Branches ? 0
=======================================
Hits ? 202
Misses ? 221
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
🎭 Visual Regression Test Results
Details
Skipped testsdesktop-chrome › theme.spec.ts › Visual Regression Tests › prob-matrix - full page screenshot |
Summary
Resolves all 4 open Dependabot security alerts plus one additional
npm auditfinding. All affected packages are transitive devDependencies underwebpack-dev-server(local dev / CI build only) — nothing in the shipped theme assets or Python package changes.Lockfile updates (
npm audit fix, all semver-compatible)Alert #75 (uuid) — dismissed, not patched
sockjspinsuuid@^8so no compatible patched version exists, and the vulnerable code is unused: the advisory (GHSA-w5hq-g745-h8pq) affectsv3/v5/v6with a caller-providedbuf, while sockjs only callsuuid.v4()with no arguments. Dismissed on the alert with reason vulnerable code is not actually used.Dependabot config
Added an
npmpackage-ecosystem entry todependabot.yml(monthly, grouped into a single PR) — previously onlygithub-actionswas covered, which is why these alerts never got automatic fix PRs.Verification
npm run buildsucceeds; webpack emits identical assets ("compared for emit")npm auditreports 0 vulnerabilities outside the dismissed uuid/sockjs chain🤖 Generated with Claude Code