fix: resolve high-severity dependabot alerts#5612
Open
svenvoskamp wants to merge 2 commits intomainfrom
Open
Conversation
Add pnpm overrides for node-forge, picomatch, path-to-regexp, and fast-xml-parser. Bump happy-dom devDependency in siwx package. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
9 Skipped Deployments
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Contributor
Visual Regression Test Results ✅ PassedChromatic Build: https://www.chromatic.com/build?appId=6493191bf4b10fed8ca7353f&number=862 👉 Please review the visual changes in Chromatic and accept or reject them. |
Contributor
📦 Bundle Size Check✅ All bundles are within size limits 📊 View detailed bundle sizes> @reown/appkit-monorepo@1.7.1 size /home/runner/work/appkit/appkit > size-limit |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix prepared fixes for both issues found in the latest run.
- ✅ Fixed: Override forces incompatible path-to-regexp on wrangler
- Removed the path-to-regexp >=8.4.0 override that was forcing incompatible v8.x on wrangler packages requiring v6.x, now resolved to compatible 6.3.0.
- ✅ Fixed: Override forces incompatible fast-xml-parser on AWS SDK
- Removed the fast-xml-parser >=5.5.6 override that was forcing incompatible v5.x on @aws-sdk/core requiring v4.x, now resolved to compatible 4.4.1.
Or push these changes by commenting:
@cursor push 958f788563
Preview (958f788563)
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -115,9 +115,7 @@
"has-ansi": "<=5.0.1",
"oxc-parser": "0.56.5",
"node-forge": ">=1.4.0",
- "picomatch": ">=4.0.4",
- "path-to-regexp": ">=8.4.0",
- "fast-xml-parser": ">=5.5.6"
+ "picomatch": ">=4.0.4"
},
"patchedDependencies": {
"@changesets/assemble-release-plan@6.0.6": "patches/@changesets__assemble-release-plan@6.0.6.patch"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -21,8 +21,6 @@
oxc-parser: 0.56.5
node-forge: '>=1.4.0'
picomatch: '>=4.0.4'
- path-to-regexp: '>=8.4.0'
- fast-xml-parser: '>=5.5.6'
patchedDependencies:
'@changesets/assemble-release-plan@6.0.6':
@@ -336,7 +334,7 @@
version: 3.9.0(react-hook-form@7.71.0(react@19.1.2))
'@next/third-parties':
specifier: 15.2.1
- version: 15.2.1(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)
+ version: 15.2.1(next@14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)
'@radix-ui/react-checkbox':
specifier: 1.3.3
version: 1.3.3(@types/react-dom@19.1.9(@types/react@19.1.15))(@types/react@19.1.15)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -402,7 +400,7 @@
version: 8.55.0
'@sentry/nextjs':
specifier: 8.55.0
- version: 8.55.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)(webpack@5.104.1)
+ version: 8.55.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)(webpack@5.104.1)
'@solana/web3.js':
specifier: 1.98.4
version: 1.98.4(bufferutil@4.1.0)(typescript@5.9.2)(utf-8-validate@5.0.10)
@@ -429,7 +427,7 @@
version: 6.14.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -986,7 +984,7 @@
version: 5.75.5(react@19.1.2)
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1035,7 +1033,7 @@
version: 2.23.7(aws4fetch@1.0.20)(db0@0.3.4)(ioredis@5.9.1)
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1081,7 +1079,7 @@
version: 2.23.7(aws4fetch@1.0.20)(bufferutil@4.1.0)(db0@0.3.4)(ioredis@5.9.1)(typescript@5.9.2)(utf-8-validate@5.0.10)(zod@4.3.5)
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1227,7 +1225,7 @@
version: 2.22.1(@tanstack/query-core@5.75.5)(@types/react@19.1.15)(react@19.1.2)(typescript@5.9.2)(use-sync-external-store@1.4.0(react@19.1.2))(viem@2.45.0(bufferutil@4.1.0)(typescript@5.9.2)(utf-8-validate@5.0.10)(zod@4.3.5))
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1273,7 +1271,7 @@
version: 2.23.7(@types/react@19.1.15)(aws4fetch@1.0.20)(bufferutil@4.1.0)(db0@0.3.4)(ioredis@5.9.1)(react@19.1.2)(typescript@5.9.2)(utf-8-validate@5.0.10)(zod@4.3.5)
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1322,7 +1320,7 @@
version: 2.22.1(@tanstack/query-core@5.75.5)(@types/react@19.1.15)(react@19.1.2)(typescript@5.9.2)(use-sync-external-store@1.4.0(react@19.1.2))(viem@2.45.0(bufferutil@4.1.0)(typescript@5.9.2)(utf-8-validate@5.0.10)(zod@4.3.5))
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1374,7 +1372,7 @@
version: 2.22.1(@tanstack/query-core@5.75.5)(@types/react@19.1.15)(react@19.1.2)(typescript@5.9.2)(use-sync-external-store@1.4.0(react@19.1.2))(viem@2.45.0(bufferutil@4.1.0)(typescript@5.9.2)(utf-8-validate@5.0.10)(zod@4.3.5))
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -1432,7 +1430,7 @@
version: 2.22.1(@tanstack/query-core@5.75.5)(@types/react@19.1.15)(react@19.1.2)(typescript@5.9.2)(use-sync-external-store@1.4.0(react@19.1.2))(viem@2.45.0(bufferutil@4.1.0)(typescript@5.9.2)(utf-8-validate@5.0.10)(zod@4.3.5))
next:
specifier: 14.2.35
- version: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ version: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
next-themes:
specifier: 0.4.6
version: 0.4.6(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
@@ -12926,13 +12924,18 @@
fast-uri@3.1.0:
resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
- fast-xml-builder@1.1.4:
- resolution: {integrity: sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==}
+ fast-xml-parser@4.2.5:
+ resolution: {integrity: sha512-B9/wizE4WngqQftFPmdaMYlXoJlJOYxGQOanC77fq9k8+Z0v5dDSVh+3glErdIROP//s/jgb7ZuxKfB8nVyo0g==}
+ hasBin: true
- fast-xml-parser@5.5.9:
- resolution: {integrity: sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==}
+ fast-xml-parser@4.4.1:
+ resolution: {integrity: sha512-xkjOecfnKGkSsOwtZ5Pz7Us/T6mrbPQrq0nh+aCO5V9nk5NLWmasAHumTKjiPJPWANe+kAZ84Jc8ooJkzZ88Sw==}
hasBin: true
+ fast-xml-parser@5.2.5:
+ resolution: {integrity: sha512-pfX9uG9Ki0yekDHx2SiuRIyFdyAr1kMIMitPvb0YBo8SUfKvia7w7FIyd/l6av85pFYRhZscS75MwMnbvY+hcQ==}
+ hasBin: true
+
fastest-levenshtein@1.0.16:
resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==}
engines: {node: '>= 4.9.1'}
@@ -15402,10 +15405,6 @@
resolution: {integrity: sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==}
engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
- path-expression-matcher@1.2.0:
- resolution: {integrity: sha512-DwmPWeFn+tq7TiyJ2CxezCAirXjFxvaiD03npak3cRjlP9+OjTmSy1EpIrEbh+l6JgUundniloMLDQ/6VTdhLQ==}
- engines: {node: '>=14.0.0'}
-
path-is-absolute@1.0.1:
resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
engines: {node: '>=0.10.0'}
@@ -15429,6 +15428,12 @@
resolution: {integrity: sha512-oWyT4gICAu+kaA7QWk/jvCHWarMKNs6pXOGWKDTr7cw4IGcUbW+PeTfbaQiLGheFRpjo6O9J0PmyMfQPjH71oA==}
engines: {node: 20 || >=22}
+ path-to-regexp@0.1.13:
+ resolution: {integrity: sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==}
+
+ path-to-regexp@6.3.0:
+ resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
path-to-regexp@8.4.1:
resolution: {integrity: sha512-fvU78fIjZ+SBM9YwCknCvKOUKkLVqtWDVctl0s7xIqfmfb38t2TT4ZU2gHm+Z8xGwgW+QWEU3oQSAzIbo89Ggw==}
@@ -16962,6 +16967,9 @@
strip-literal@3.1.0:
resolution: {integrity: sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==}
+ strnum@1.1.2:
+ resolution: {integrity: sha512-vrN+B7DBIoTTZjnPNewwhx6cBA/H+IS7rfW68n7XxC1y7uoiGQBxaKzqucGUgavX15dJgiGztLJ8vxuEzwqBdA==}
+
strnum@2.2.2:
resolution: {integrity: sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==}
@@ -18887,7 +18895,7 @@
'@smithy/util-stream': 2.2.0
'@smithy/util-utf8': 2.3.0
'@smithy/util-waiter': 2.2.0
- fast-xml-parser: 5.5.9
+ fast-xml-parser: 4.2.5
tslib: 2.8.1
transitivePeerDependencies:
- aws-crt
@@ -19301,7 +19309,7 @@
'@smithy/util-defaults-mode-node': 2.3.1
'@smithy/util-retry': 2.2.0
'@smithy/util-utf8': 2.3.0
- fast-xml-parser: 5.5.9
+ fast-xml-parser: 4.2.5
tslib: 2.8.1
transitivePeerDependencies:
- aws-crt
@@ -19317,7 +19325,7 @@
'@smithy/smithy-client': 4.10.5
'@smithy/types': 4.11.0
'@smithy/util-middleware': 4.2.7
- fast-xml-parser: 5.5.9
+ fast-xml-parser: 4.4.1
tslib: 2.8.1
'@aws-sdk/core@3.967.0':
@@ -20074,7 +20082,7 @@
'@aws-sdk/xml-builder@3.965.0':
dependencies:
'@smithy/types': 4.11.0
- fast-xml-parser: 5.5.9
+ fast-xml-parser: 5.2.5
tslib: 2.8.1
'@aws/lambda-invoke-store@0.2.3': {}
@@ -23197,9 +23205,9 @@
'@next/swc-win32-x64-msvc@15.5.7':
optional: true
- '@next/third-parties@15.2.1(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)':
+ '@next/third-parties@15.2.1(next@14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)':
dependencies:
- next: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ next: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
react: 19.1.2
third-party-capital: 1.0.20
@@ -23831,7 +23839,7 @@
cookie: 1.1.1
esbuild: 0.27.2
express: 5.0.1
- path-to-regexp: 8.4.1
+ path-to-regexp: 6.3.0
urlpattern-polyfill: 10.1.0
yaml: 2.8.2
transitivePeerDependencies:
@@ -28407,7 +28415,7 @@
'@sentry/utils': 7.120.3
localforage: 1.10.0
- '@sentry/nextjs@8.55.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)(webpack@5.104.1)':
+ '@sentry/nextjs@8.55.0(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(next@14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2))(react@19.1.2)(webpack@5.104.1)':
dependencies:
'@opentelemetry/api': 1.9.0
'@opentelemetry/semantic-conventions': 1.38.0
@@ -28420,7 +28428,7 @@
'@sentry/vercel-edge': 8.55.0
'@sentry/webpack-plugin': 2.22.7(webpack@5.104.1)
chalk: 4.1.2
- next: 14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
+ next: 14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2)
resolve: 1.22.8
rollup: 3.29.5
stacktrace-parser: 0.1.11
@@ -36953,7 +36961,7 @@
eslint: 8.56.0
eslint-import-resolver-node: 0.3.9
eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.8.3))(eslint@8.56.0))(eslint@8.56.0)
- eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.8.3))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0)
+ eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@8.56.0)
eslint-plugin-jsx-a11y: 6.10.2(eslint@8.56.0)
eslint-plugin-react: 7.37.5(eslint@8.56.0)
eslint-plugin-react-hooks: 5.0.0-canary-7118f5dd7-20230705(eslint@8.56.0)
@@ -36991,8 +36999,8 @@
'@typescript-eslint/parser': 6.18.1(eslint@8.56.0)(typescript@5.9.2)
eslint: 8.56.0
eslint-import-resolver-node: 0.3.9
- eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0)
- eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0)
+ eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.8.3))(eslint@8.56.0))(eslint@8.56.0)
+ eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@8.56.0)
eslint-plugin-jsx-a11y: 6.10.2(eslint@8.56.0)
eslint-plugin-react: 7.37.5(eslint@8.56.0)
eslint-plugin-react-hooks: 5.2.0(eslint@8.56.0)
@@ -37009,7 +37017,7 @@
eslint: 9.39.1(jiti@2.6.1)
eslint-import-resolver-node: 0.3.9
eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1))
- eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1))
+ eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.1(jiti@2.6.1))
eslint-plugin-jsx-a11y: 6.10.2(eslint@9.39.1(jiti@2.6.1))
eslint-plugin-react: 7.37.5(eslint@9.39.1(jiti@2.6.1))
eslint-plugin-react-hooks: 7.0.1(eslint@9.39.1(jiti@2.6.1))
@@ -37046,25 +37054,10 @@
tinyglobby: 0.2.15
unrs-resolver: 1.11.1
optionalDependencies:
- eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.8.3))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0)
+ eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@8.56.0)
transitivePeerDependencies:
- supports-color
- eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0):
- dependencies:
- '@nolyfill/is-core-module': 1.0.39
- debug: 4.4.3
- eslint: 8.56.0
- get-tsconfig: 4.13.0
- is-bun-module: 2.0.0
- stable-hash: 0.0.5
- tinyglobby: 0.2.15
- unrs-resolver: 1.11.1
- optionalDependencies:
- eslint-plugin-import: 2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0)
- transitivePeerDependencies:
- - supports-color
-
eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1)):
dependencies:
'@nolyfill/is-core-module': 1.0.39
@@ -37076,7 +37069,7 @@
tinyglobby: 0.2.15
unrs-resolver: 1.11.1
optionalDependencies:
- eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1))
+ eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.1(jiti@2.6.1))
transitivePeerDependencies:
- supports-color
@@ -37106,17 +37099,6 @@
transitivePeerDependencies:
- supports-color
- eslint-module-utils@2.12.1(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0):
- dependencies:
- debug: 3.2.7
- optionalDependencies:
- '@typescript-eslint/parser': 6.18.1(eslint@8.56.0)(typescript@5.9.2)
- eslint: 8.56.0
- eslint-import-resolver-node: 0.3.9
- eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0)
- transitivePeerDependencies:
- - supports-color
-
eslint-module-utils@2.12.1(@typescript-eslint/parser@6.18.1(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0)(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1)):
dependencies:
debug: 3.2.7
@@ -37139,7 +37121,7 @@
transitivePeerDependencies:
- supports-color
- eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.8.3))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0):
+ eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@8.56.0):
dependencies:
'@rtsao/scc': 1.1.0
array-includes: 3.1.9
@@ -37168,35 +37150,6 @@
- eslint-import-resolver-webpack
- supports-color
- eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0):
- dependencies:
- '@rtsao/scc': 1.1.0
- array-includes: 3.1.9
- array.prototype.findlastindex: 1.2.6
- array.prototype.flat: 1.3.3
- array.prototype.flatmap: 1.3.3
- debug: 3.2.7
- doctrine: 2.1.0
- eslint: 8.56.0
- eslint-import-resolver-node: 0.3.9
- eslint-module-utils: 2.12.1(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@8.56.0)(typescript@5.9.2))(eslint@8.56.0))(eslint@8.56.0))(eslint@8.56.0)
- hasown: 2.0.2
- is-core-module: 2.13.1
- is-glob: 4.0.3
- minimatch: 3.1.2
- object.fromentries: 2.0.8
- object.groupby: 1.0.3
- object.values: 1.2.1
- semver: 6.3.1
- string.prototype.trimend: 1.0.9
- tsconfig-paths: 3.15.0
- optionalDependencies:
- '@typescript-eslint/parser': 6.18.1(eslint@8.56.0)(typescript@5.9.2)
- transitivePeerDependencies:
- - eslint-import-resolver-typescript
- - eslint-import-resolver-webpack
- - supports-color
-
eslint-plugin-import@2.32.0(@typescript-eslint/parser@6.18.1(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.1(jiti@2.6.1)):
dependencies:
'@rtsao/scc': 1.1.0
@@ -37226,7 +37179,7 @@
- eslint-import-resolver-webpack
- supports-color
- eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1(eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1)))(eslint@9.39.1(jiti@2.6.1)):
+ eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.53.0(eslint@9.39.1(jiti@2.6.1))(typescript@5.9.2))(eslint-import-resolver-typescript@3.10.1)(eslint@9.39.1(jiti@2.6.1)):
dependencies:
'@rtsao/scc': 1.1.0
array-includes: 3.1.9
@@ -37738,7 +37691,7 @@
methods: 1.1.2
on-finished: 2.4.1
parseurl: 1.3.3
- path-to-regexp: 8.4.1
+ path-to-regexp: 0.1.13
proxy-addr: 2.0.7
qs: 6.14.1
range-parser: 1.2.1
@@ -37857,14 +37810,16 @@
fast-uri@3.1.0: {}
- fast-xml-builder@1.1.4:
+ fast-xml-parser@4.2.5:
dependencies:
- path-expression-matcher: 1.2.0
+ strnum: 1.1.2
- fast-xml-parser@5.5.9:
+ fast-xml-parser@4.4.1:
dependencies:
- fast-xml-builder: 1.1.4
- path-expression-matcher: 1.2.0
+ strnum: 1.1.2
+
+ fast-xml-parser@5.2.5:
+ dependencies:
strnum: 2.2.2
fastest-levenshtein@1.0.16: {}
@@ -39882,7 +39837,7 @@
react: 19.2.1
react-dom: 19.2.1(react@19.2.1)
- next@14.2.35(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2):
+ next@14.2.35(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.48.2)(react-dom@19.1.2(react@19.1.2))(react@19.1.2):
dependencies:
'@next/env': 14.2.35
'@swc/helpers': 0.5.5
@@ -39892,7 +39847,7 @@
postcss: 8.4.31
react: 19.1.2
react-dom: 19.1.2(react@19.1.2)
- styled-jsx: 5.1.1(react@19.1.2)
+ styled-jsx: 5.1.1(@babel/core@7.28.6)(react@19.1.2)
optionalDependencies:
'@next/swc-darwin-arm64': 14.2.33
'@next/swc-darwin-x64': 14.2.33
@@ -41132,8 +41087,6 @@
path-exists@5.0.0: {}
- path-expression-matcher@1.2.0: {}
-
path-is-absolute@1.0.1: {}
path-key@3.1.1: {}
@@ -41152,6 +41105,10 @@
lru-cache: 11.2.4
minipass: 7.1.2
+ path-to-regexp@0.1.13: {}
+
+ path-to-regexp@6.3.0: {}
+
path-to-regexp@8.4.1: {}
path-type@4.0.0: {}
@@ -43095,14 +43052,18 @@
dependencies:
js-tokens: 9.0.1
+ strnum@1.1.2: {}
+
strnum@2.2.2: {}
structured-clone-es@1.0.0: {}
- styled-jsx@5.1.1(react@19.1.2):
+ styled-jsx@5.1.1(@babel/core@7.28.6)(react@19.1.2):
dependencies:
client-only: 0.0.1
react: 19.1.2
+ optionalDependencies:
+ '@babel/core': 7.28.6
styled-jsx@5.1.6(react@19.1.2):
dependencies:
@@ -45400,7 +45361,7 @@
esbuild: 0.27.2
miniflare: 3.20241011.0(bufferutil@4.1.0)(utf-8-validate@5.0.10)
nanoid: 3.3.11
- path-to-regexp: 8.4.1
+ path-to-regexp: 6.3.0
resolve: 1.22.11
resolve.exports: 2.0.3
selfsigned: 2.4.1
@@ -45423,7 +45384,7 @@
blake3-wasm: 2.1.5
esbuild: 0.27.2
miniflare: 4.20250712.1(bufferutil@4.1.0)(utf-8-validate@5.0.10)
- path-to-regexp: 8.4.1
+ path-to-regexp: 6.3.0
unenv: 2.0.0-rc.17
workerd: 1.20250712.0
optionalDependencies:This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.
| "oxc-parser": "0.56.5", | ||
| "node-forge": ">=1.4.0", | ||
| "picomatch": ">=4.0.4", | ||
| "path-to-regexp": ">=8.4.0", |
There was a problem hiding this comment.
Override forces incompatible path-to-regexp on wrangler
Medium Severity
The path-to-regexp override >=8.4.0 forces wrangler@3.81.0 (depends on ^6.3.0) and wrangler@4.25.1 (depends on ^6.2.1) to resolve to 8.4.1. The path-to-regexp API changed significantly between 6.x and 8.x: pathToRegexp() returns { regexp, keys } instead of a RegExp, loose mode was removed, group suffixes were removed, and wildcard syntax changed. This could break wrangler's route matching during local dev and deployment. Similarly affects @opennextjs/aws which also depends on 6.x.
Additional Locations (2)
| "node-forge": ">=1.4.0", | ||
| "picomatch": ">=4.0.4", | ||
| "path-to-regexp": ">=8.4.0", | ||
| "fast-xml-parser": ">=5.5.6" |
There was a problem hiding this comment.
Override forces incompatible fast-xml-parser on AWS SDK
Medium Severity
The fast-xml-parser override >=5.5.6 forces @aws-sdk/core@3.758.0 (depends on ^4.4.1), @aws-sdk/client-cloudformation, and @aws-sdk/client-s3 (depend on ^4.2.5) from version 4.x to 5.5.9. Version 5.x restructured its internals significantly — XMLBuilder was separated into a standalone fast-xml-builder package, and new dependencies like path-expression-matcher were added. This major version jump could cause XML parsing failures in these older AWS SDK packages used by @opennextjs/aws.
Additional Locations (2)
Contributor
Coverage Report
File CoverageNo changed files found. |
0xmkh
approved these changes
Mar 31, 2026
|
You have used all of your free Bugbot PR reviews. To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
node-forge(>=1.4.0),picomatch(>=4.0.4),path-to-regexp(>=8.4.0), andfast-xml-parser(>=5.5.6) to resolve 10 high-severity dependabot alerts in transitive dependencieshappy-domfrom 15.11.7 to 20.8.9 inpackages/siwx(devDependency) to resolve 4 high-severity alertsTest plan
pnpm installsucceedspnpm buildpasses (24/24 packages)pnpm testpasses (3186 tests, 246 test files)🤖 Generated with Claude Code
Note
Medium Risk
Primarily dependency/lockfile changes, but they can subtly affect runtime/tooling behavior and
happy-dom@20now requires Node >=20, which could break CI or contributor environments on older Node versions.Overview
Resolves high-severity Dependabot alerts by adding
pnpm.overridesfornode-forge,picomatch,path-to-regexp, andfast-xml-parserin the rootpackage.json.Upgrades
happy-domfrom15.11.7to20.8.9(notably changing its Node engine requirements) and refreshespnpm-lock.yamlto reflect the new resolved dependency graph.Written by Cursor Bugbot for commit 2d34475. This will update automatically on new commits. Configure here.