fix(deps): remove 19 stale resolutions (audit 2026-05-18)#225
Open
mluena wants to merge 19 commits into
Open
Conversation
socks@2.8.7 declares ip-address ^10.0.1, which now naturally resolves to 10.2.0 (patched). The scoped resolution is redundant.
css-loader@6.11.0 declares postcss ^8.4.33, which now resolves to 8.5.14 (patched). The scoped resolution is redundant.
sanitize-html@2.10.0 declares postcss ^8.3.11, which now resolves to 8.5.14 (patched). The scoped resolution is redundant.
tailwindcss@3.3.2 declares postcss ^8.4.23, which now resolves to 8.5.14 (patched). The scoped resolution is redundant.
axios@1.16.0 declares follow-redirects ^1.16.0, which resolves to the patched 1.16.0 (current latest). The scoped resolution is redundant.
follow-redirects naturally resolves to the patched 1.16.0 (latest) via dedup with axios's narrower ^1.16.0 constraint. The scoped http-proxy override is redundant.
…ma override resolve-protobuf-schema@2.1.0 declares protocol-buffers-schema ^3.3.1, which now resolves to the patched 3.6.1. The scoped resolution is redundant.
Audit stays clean: parents pulling lodash@4.17.x now resolve naturally (4.17.21 and 4.17.23 are not vulnerable), and ranges `^4.17.x` pick the current latest 4.18.1. The blanket override is redundant.
Audit stays clean: lodash-es resolves naturally to current latest (4.18.1) via parents' semver ranges. The blanket override is redundant.
Audit stays clean: node-forge resolves naturally to current latest (1.4.0) via parents' semver ranges. The blanket override is redundant.
Audit stays clean: handlebars resolves naturally to current latest (4.7.9) via parents' semver ranges. The blanket override is redundant.
Audit stays clean: braces resolves naturally to current latest (3.0.3) via parents' semver ranges. The blanket override is redundant.
Audit stays clean: fast-uri resolves naturally to current latest (3.1.2) via parents' semver ranges. The blanket override is redundant.
…lution Audit stays clean: the plugin resolves naturally to current latest (7.29.4) via parents' semver ranges. The blanket override is redundant.
Audit no longer flags semver@7.5.1 (transitive via Strapi v4). The version-keyed override is redundant under current advisory data.
Audit no longer flags path-to-regexp@6.2.1 (transitive via Strapi v4). The version-keyed override is redundant under current advisory data.
path-to-regexp resolves naturally to 0.1.13 (patched) via the parent's ~0.1.12 range. The version-keyed override is redundant.
brace-expansion now resolves to 2.1.0 (patched) via the ^2.0.1 range in the maintenance-v2 line. The version-keyed override is redundant.
Audit no longer flags ws@8.13.0 (transitive via Strapi v4). The version-keyed override is redundant under current advisory data.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Override-hygiene pass per
/vizz-core:fix-vulnerabilitiesguidelines §3. Removed 19 stale entries from rootpackage.jsonresolutionsthat no longer affect audit outcomes — each as its own atomic commit, independently revertable.Removed (19)
Scoped overrides (7) — parent's semver range now resolves to a patched transitive natively:
socks>ip-address(→ 10.2.0)css-loader>postcss(→ 8.5.14)sanitize-html>postcss(→ 8.5.14)tailwindcss>postcss(→ 8.5.14)axios>follow-redirects(→ 1.16.0)http-proxy>follow-redirects(→ 1.16.0)resolve-protobuf-schema>protocol-buffers-schema(→ 3.6.1)Blanket overrides (7) — pin matched current
latest, removal is a no-op or audit-safe:lodash,lodash-es,node-forge,handlebars,braces,fast-uri,@babel/plugin-transform-modules-systemjsVersion-keyed (5) — audit no longer flags the targeted version, or natural semver picks patched:
semver@7.5.1,path-to-regexp@6.2.1,path-to-regexp@~0.1.12,brace-expansion@^2.0.1,ws@8.13.0Kept (load-bearing)
@strapi/plugin-upload>sharp— blocked behind Strapi v5 migration@stoplight/spectral-core>minimatch— parent pinsminimatch: 3.1.2exactkoa— Strapi v4 pinskoa: 2.13.4exact (vulnerable)fast-xml-parser—@aws-sdk/corepins4.2.5exact (ReDoS); removal regressed the tree, reverted in-sessionfindup-sync>micromatch,@orval/core>esbuild,esbuild-loader>esbuild— parent ranges still resolve to vulnerable transitivesDeferred — Strapi v4 → v5 migration
Two open advisories remain (both require Strapi major upgrade — explicit user approval required per guidelines §8, and migration is out of scope for a dep-audit PR):
@strapi/strapi@strapi/plugin-users-permissionsTrack Strapi v5 migration separately (content-type schemas, document service API,
cms/src/plugins/map-field/, third-party Strapi plugins, Node engine pin).Test plan
yarn installsucceeds; lockfile coherentyarn npm audit -Ainclient/→ only the 2 deferred Strapi advisoriesyarn npm audit -Aincms/→ only the 2 deferred Strapi advisoriesuvx uv-secureindata-processing/→ 0 vulnerabilities (175 deps)yarn testinclient/→ 6 Playwright tests passyarn check-typesinclient/→ 35 errors, identical todevelopbaseline (pre-existing, not introduced here)cmsbuild sanity-check on review