fix(deps): resolve high severity audit vulnerabilities by denolfe · Pull Request #18158 · payloadcms/payload

denolfe · 2026-09-10T18:13:08Z

Fixes the high-severity advisories reported by pnpm audit --prod (run via .github/workflows/audit-dependencies.sh high). The audit exits 0 and build:core passes. No pnpm.overrides were needed. Each fix is a direct version bump or a lockfile refresh where the patched version already fell inside the parent's ^ range.

Key Changes

Direct version bumps (exact pins we own)
- undici 7.28.0 to 7.29.1 in packages/payload. Stays within v7, no code change. Fixes advisories including GHSA-vxpw-j846-p89q (WebSocket DoS).
- sharp 0.34.2 to 0.35.4 across the templates. Fixes advisories including GHSA-f88m-g3jw-g9cj (inherited libvips CVEs).
- sharp 0.32.6 to 0.35.4 in the root devDependencies. A minimizer-webpack-plugin > sharp optional peer declares an unbounded (*) range. pnpm satisfied it from this root pin, so the bump clears the deep transitive finding without an override.
Range floor raised, lockfile refreshed (fix already in range)
- nodemailer ^9.0.1 to ^9.1.1 in email-nodemailer and payload-cloud. Fixes GHSA-2x7j-588g-ccc2 (addressparser DoS).
- tar ^7.5.7 to ^7.5.22 in create-payload-app. Fixes advisories including GHSA-r292-9mhp-454m (recursion stack-overflow DoS).
Transitive-only, lockfile refresh (no package.json change)
- brace-expansion (GHSA-rgw5-rvv9-x895), fast-uri (GHSA-fph4-wmhf-6fwf), js-yaml (GHSA-pm4m-ph32-ghv5), nanoid (GHSA-xwg4-73v4-xw9w), fast-xml-parser (GHSA-8r6m-32jq-jx6q), browserslist (GHSA-c83g-rgw3-j3cx).

socket-security · 2026-09-10T18:14:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tar@7.5.19 ⏵ 7.5.22		⁺¹⁶	⁺¹
	nodemailer@9.0.3 ⏵ 9.1.1		⁺²⁰

View full report

github-actions · 2026-09-10T18:18:35Z

📦 esbuild Bundle Analysis for payload

This analysis was generated by esbuild-bundle-analyzer. 🤖

Meta File	Out File	Size (raw)	Note
packages/next/meta_index.json	esbuild/index.js	214.77 KB	✅ No change
packages/payload/meta_index.json	esbuild/index.js	1.80 MB	⚠️ +11.02 KB (+0.6%)
packages/payload/meta_shared.json	esbuild/exports/shared.js	549.31 KB	✅ No change
packages/richtext-lexical/meta_client.json	esbuild/exports/client_optimized/index.js	286.46 KB	✅ No change
packages/ui/meta_client.json	esbuild/exports/client_optimized/index.js	36.54 KB	✅ No change
packages/ui/meta_shared.json	esbuild/exports/shared_optimized/index.js	18.95 KB	✅ No change

Largest paths

These visualization shows top 20 largest paths in the bundle.

Meta file: packages/next/meta_index.json, Out file: esbuild/index.js

Path	Size
../../node_modules	${{\color{Goldenrod}{ ████████████████████████▊ }}}$ 99.0%, 210.74 KB
dist/adapters/router.js	${{\color{Goldenrod}{ }}}$ 0.3%, 718 B
dist/adapters/server.js	${{\color{Goldenrod}{ }}}$ 0.3%, 533 B
dist/adapters/layout.js	${{\color{Goldenrod}{ }}}$ 0.2%, 526 B
dist/adapters/views.js	${{\color{Goldenrod}{ }}}$ 0.2%, 409 B
dist/esbuildEntry.js	${{\color{Goldenrod}{ }}}$ 0.0%, 0 B

Meta file: packages/payload/meta_index.json, Out file: esbuild/index.js

Path	Size
../../node_modules	${{\color{Goldenrod}{ ██████████████████▎ }}}$ 73.2%, 1.31 MB
dist/collections/operations	${{\color{Goldenrod}{ ▋ }}}$ 2.6%, 46.72 KB
dist/fields/hooks	${{\color{Goldenrod}{ ▋ }}}$ 2.5%, 44.42 KB
dist/utilities/configToJSONSchema.js	${{\color{Goldenrod}{ ▏ }}}$ 0.9%, 16.02 KB
dist/auth/operations	${{\color{Goldenrod}{ ▏ }}}$ 0.9%, 15.59 KB
dist/globals/operations	${{\color{Goldenrod}{ ▏ }}}$ 0.8%, 14.30 KB
dist/queues/operations	${{\color{Goldenrod}{ ▏ }}}$ 0.8%, 14.29 KB
dist/fields/config	${{\color{Goldenrod}{ ▏ }}}$ 0.8%, 13.64 KB
dist/utilities/telemetry	${{\color{Goldenrod}{ ▏ }}}$ 0.7%, 11.88 KB
dist/fields/validations.js	${{\color{Goldenrod}{ ▏ }}}$ 0.6%, 10.76 KB
dist/collections/config	${{\color{Goldenrod}{ ▏ }}}$ 0.6%, 9.94 KB
dist/cli/commands	${{\color{Goldenrod}{ ▏ }}}$ 0.6%, 9.92 KB
dist/config/orderable	${{\color{Goldenrod}{ ▏ }}}$ 0.5%, 8.10 KB
dist/database/migrations	${{\color{Goldenrod}{ }}}$ 0.4%, 7.99 KB
dist/uploads/fetchAPI-multipart	${{\color{Goldenrod}{ }}}$ 0.4%, 7.87 KB
dist/index.js	${{\color{Goldenrod}{ }}}$ 0.4%, 7.79 KB
dist/hierarchy/utils	${{\color{Goldenrod}{ }}}$ 0.4%, 7.65 KB
dist/utilities/entityInputSchema	${{\color{Goldenrod}{ }}}$ 0.4%, 7.34 KB
dist/config/sanitize.js	${{\color{Goldenrod}{ }}}$ 0.4%, 7.07 KB
dist/collections/endpoints	${{\color{Goldenrod}{ }}}$ 0.3%, 6.17 KB
(other)	${{\color{Goldenrod}{ ██████▋ }}}$ 26.8%, 480.24 KB

Meta file: packages/payload/meta_shared.json, Out file: esbuild/exports/shared.js

Path	Size
../../node_modules	${{\color{Goldenrod}{ ██████████████████████▎ }}}$ 89.2%, 485.60 KB
dist/fields/validations.js	${{\color{Goldenrod}{ ▌ }}}$ 2.0%, 10.73 KB
dist/fields/config	${{\color{Goldenrod}{ ▎ }}}$ 1.1%, 5.83 KB
dist/utilities/traverseFields.js	${{\color{Goldenrod}{ ▏ }}}$ 0.8%, 4.45 KB
dist/collections/config	${{\color{Goldenrod}{ ▏ }}}$ 0.6%, 3.33 KB
dist/config/orderable	${{\color{Goldenrod}{ ▏ }}}$ 0.6%, 3.13 KB
dist/fields/baseFields	${{\color{Goldenrod}{ ▏ }}}$ 0.5%, 2.79 KB
dist/utilities/deepCopyObject.js	${{\color{Goldenrod}{ ▏ }}}$ 0.5%, 2.69 KB
dist/config/client.js	${{\color{Goldenrod}{ ▏ }}}$ 0.5%, 2.69 KB
dist/auth/cookies.js	${{\color{Goldenrod}{ }}}$ 0.3%, 1.55 KB
dist/utilities/flattenTopLevelFields.js	${{\color{Goldenrod}{ }}}$ 0.3%, 1.42 KB
dist/utilities/getVersionsConfig.js	${{\color{Goldenrod}{ }}}$ 0.2%, 1.04 KB
dist/globals/config	${{\color{Goldenrod}{ }}}$ 0.2%, 939 B
dist/utilities/flattenAllFields.js	${{\color{Goldenrod}{ }}}$ 0.1%, 794 B
dist/utilities/unflatten.js	${{\color{Goldenrod}{ }}}$ 0.1%, 779 B
dist/utilities/sanitizeUserDataForEmail.js	${{\color{Goldenrod}{ }}}$ 0.1%, 713 B
dist/auth/extractJWT.js	${{\color{Goldenrod}{ }}}$ 0.1%, 696 B
dist/utilities/getFieldPermissions.js	${{\color{Goldenrod}{ }}}$ 0.1%, 651 B
dist/utilities/getSafeRedirect.js	${{\color{Goldenrod}{ }}}$ 0.1%, 632 B
dist/errors/ValidationError.js	${{\color{Goldenrod}{ }}}$ 0.1%, 577 B
(other)	${{\color{Goldenrod}{ ██▋ }}}$ 10.8%, 59.04 KB

Meta file: packages/richtext-lexical/meta_client.json, Out file: esbuild/exports/client_optimized/index.js

Path	Size
dist/features/blocks	${{\color{Goldenrod}{ ███▎ }}}$ 13.1%, 37.20 KB
dist/lexical/ui	${{\color{Goldenrod}{ ███ }}}$ 12.1%, 34.20 KB
dist/lexical/plugins	${{\color{Goldenrod}{ ██▉ }}}$ 11.7%, 33.01 KB
dist/features/table	${{\color{Goldenrod}{ ██▍ }}}$ 9.6%, 27.18 KB
dist/features/link	${{\color{Goldenrod}{ █▋ }}}$ 6.6%, 18.82 KB
dist/features/toolbars	${{\color{Goldenrod}{ █▌ }}}$ 6.2%, 17.45 KB
dist/features/upload	${{\color{Goldenrod}{ █▎ }}}$ 5.0%, 14.28 KB
dist/features/textState	${{\color{Goldenrod}{ ▉ }}}$ 3.9%, 11.08 KB
dist/lexical/utils	${{\color{Goldenrod}{ ▉ }}}$ 3.5%, 10.02 KB
dist/features/relationship	${{\color{Goldenrod}{ ▊ }}}$ 3.4%, 9.61 KB
dist/features/converters	${{\color{Goldenrod}{ ▊ }}}$ 3.0%, 8.36 KB
dist/utilities/fieldsDrawer	${{\color{Goldenrod}{ ▋ }}}$ 2.9%, 8.12 KB
dist/features/debug	${{\color{Goldenrod}{ ▋ }}}$ 2.6%, 7.40 KB
dist/lexical/config	${{\color{Goldenrod}{ ▍ }}}$ 1.8%, 5.14 KB
dist/features/lists	${{\color{Goldenrod}{ ▎ }}}$ 1.3%, 3.64 KB
dist/features/format	${{\color{Goldenrod}{ ▎ }}}$ 1.2%, 3.28 KB
dist/lexical/LexicalEditor.js	${{\color{Goldenrod}{ ▎ }}}$ 1.1%, 3.23 KB
dist/features/horizontalRule	${{\color{Goldenrod}{ ▎ }}}$ 1.1%, 3.18 KB
dist/field/Field.js	${{\color{Goldenrod}{ ▎ }}}$ 1.0%, 2.88 KB
dist/lexical/nodes	${{\color{Goldenrod}{ ▏ }}}$ 0.9%, 2.66 KB
(other)	${{\color{Goldenrod}{ █████████████████████▋ }}}$ 86.9%, 246.05 KB

Meta file: packages/ui/meta_client.json, Out file: esbuild/exports/client_optimized/index.js

Path	Size
dist/exports/client	${{\color{Goldenrod}{ █████████████████████████ }}}$ 100.0%, 26.90 KB

Meta file: packages/ui/meta_shared.json, Out file: esbuild/exports/shared_optimized/index.js

Path	Size
dist/graphics/Logo	${{\color{Goldenrod}{ ███████▋ }}}$ 30.5%, 5.57 KB
../../node_modules	${{\color{Goldenrod}{ ███▌ }}}$ 14.5%, 2.65 KB
dist/graphics/Icon	${{\color{Goldenrod}{ ██ }}}$ 8.3%, 1.51 KB
dist/utilities/formatDocTitle	${{\color{Goldenrod}{ █▊ }}}$ 7.2%, 1.32 KB
dist/providers/TableColumns	${{\color{Goldenrod}{ █▏ }}}$ 4.7%, 866 B
dist/utilities/getGlobalData.js	${{\color{Goldenrod}{ █ }}}$ 4.2%, 762 B
dist/utilities/api.js	${{\color{Goldenrod}{ █ }}}$ 4.1%, 756 B
dist/utilities/groupNavItems.js	${{\color{Goldenrod}{ █ }}}$ 4.1%, 745 B
dist/elements/Translation	${{\color{Goldenrod}{ ▋ }}}$ 2.7%, 493 B
dist/utilities/handleTakeOver.js	${{\color{Goldenrod}{ ▌ }}}$ 2.4%, 440 B
dist/utilities/traverseForLocalizedFields.js	${{\color{Goldenrod}{ ▌ }}}$ 2.3%, 419 B
dist/elements/withMergedProps	${{\color{Goldenrod}{ ▍ }}}$ 1.9%, 339 B
dist/utilities/getNavGroups.js	${{\color{Goldenrod}{ ▍ }}}$ 1.9%, 338 B
dist/utilities/getVisibleEntities.js	${{\color{Goldenrod}{ ▍ }}}$ 1.8%, 329 B
dist/elements/WithServerSideProps	${{\color{Goldenrod}{ ▎ }}}$ 1.3%, 232 B
dist/layouts/Root	${{\color{Goldenrod}{ ▎ }}}$ 1.3%, 230 B
dist/utilities/handleGoBack.js	${{\color{Goldenrod}{ ▎ }}}$ 1.0%, 180 B
dist/fields/mergeFieldStyles.js	${{\color{Goldenrod}{ ▏ }}}$ 0.9%, 158 B
dist/forms/Form	${{\color{Goldenrod}{ ▏ }}}$ 0.8%, 152 B
dist/utilities/handleBackToDashboard.js	${{\color{Goldenrod}{ ▏ }}}$ 0.8%, 152 B
(other)	${{\color{Goldenrod}{ █████████████████▍ }}}$ 69.5%, 12.68 KB

Details

Next to the size is how much the size has increased or decreased compared with the base branch of this PR.

‼️: Size increased by 20% or more. Special attention should be given to this.
⚠️: Size increased in acceptable range (lower than 20%).
✅: No change or even downsized.
🗑️: The out file is deleted: not found in base branch.
🆕: The out file is newly found: will be added to base branch.

fix(deps): resolve high severity audit vulnerabilities

81bd1eb

github-actions Bot added the created-by: Payload team label Sep 10, 2026

denolfe marked this pull request as ready for review September 10, 2026 18:39

Navigation Menu

Uh oh!

fix(deps): resolve high severity audit vulnerabilities - #18158

fix(deps): resolve high severity audit vulnerabilities#18158
denolfe wants to merge 1 commit into
mainfrom
fix/audit-deps

denolfe commented Sep 10, 2026

Uh oh!

socket-security Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

Meta file: packages/next/meta_index.json, Out file: esbuild/index.js

Meta file: packages/payload/meta_index.json, Out file: esbuild/index.js

Meta file: packages/payload/meta_shared.json, Out file: esbuild/exports/shared.js

Meta file: packages/richtext-lexical/meta_client.json, Out file: esbuild/exports/client_optimized/index.js

Meta file: packages/ui/meta_client.json, Out file: esbuild/exports/client_optimized/index.js

Meta file: packages/ui/meta_shared.json, Out file: esbuild/exports/shared_optimized/index.js

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

denolfe commented Sep 10, 2026

Key Changes

Uh oh!

socket-security Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

📦 esbuild Bundle Analysis for payload

Meta file: packages/next/meta_index.json, Out file: esbuild/index.js

Meta file: packages/payload/meta_index.json, Out file: esbuild/index.js

Meta file: packages/payload/meta_shared.json, Out file: esbuild/exports/shared.js

Meta file: packages/richtext-lexical/meta_client.json, Out file: esbuild/exports/client_optimized/index.js

Meta file: packages/ui/meta_client.json, Out file: esbuild/exports/client_optimized/index.js

Meta file: packages/ui/meta_shared.json, Out file: esbuild/exports/shared_optimized/index.js

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant