fix(security): resolve 22 dependabot alerts via workspace overrides#3250
Merged
Conversation
Addresses the following Dependabot security advisories by lifting transitive dependency floors in pnpm-workspace.yaml `overrides:`. All affected packages are dev-scoped (build/test/visual-regression tooling) — no runtime impact on publishable @commercetools-uikit/* packages. Bumped existing overrides: - axios: ^1.13.5 → ^1.15.2 CVE-2025-62718, CVE-2026-40175, CVE-2026-42033, CVE-2026-42035, CVE-2026-42037, CVE-2026-42038, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026-42043, CVE-2026-42044, CVE-2026-42264 - basic-ftp: ^5.2.0 → ^5.2.2 CVE-2026-39983, GHSA-6v7q-wjvx-w8wg - systeminformation: ^5.31.0 → ^5.31.6 CVE-2026-44724 Added new overrides: - '@babel/plugin-transform-modules-systemjs': ^7.29.4 (CVE-2026-44728) - fast-uri: ^3.1.2 (CVE-2026-6321, CVE-2026-6322) - follow-redirects: ^1.16.0 (GHSA-r4q5-vmmm-2653) - ip-address: ^10.1.1 (CVE-2026-42338) - 'js-yaml@^4.0.0': ^4.1.1 (CVE-2025-64718) — scoped to 4.x line so the unaffected 3.14.2 (istanbul tooling) keeps resolving normally - postcss: ^8.5.10 (CVE-2026-41305) — catalog `postcss: 8.5.15` is already safe; the override lifts a stale vite transitive (8.5.6) Removed stale overrides (no parent in the current tree declares them): - '@isaacs/brace-expansion': ^5.0.1 - got: 14.5.0 - tar: ^7.5.11
misama-ct
added
dependencies
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
valoriecarli
approved these changes
May 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 22 open Dependabot security alerts by lifting transitive dependency floors in
pnpm-workspace.yamloverrides:. Every affected package is dev-scoped (build/test/visual-regression tooling — axios via Bundlewatch & Puppeteer, basic-ftp/ip-address via Percy, postcss via Vite, etc.), so there is no runtime impact on publishable@commercetools-uikit/*packages and no changeset is required.🔒 Vulnerabilities Fixed
axiosbasic-ftpsysteminformation@babel/plugin-transform-modules-systemjsfast-urifollow-redirectsip-addressjs-yamlpostcssNone — all 22 alerts had a SemVer-compatible patched version and were auto-fixable via overrides.
🧹 Overrides Changes
Added
@babel/plugin-transform-modules-systemjs^7.29.4@babel/preset-env@7.29.2fast-uri^3.1.2ajv@8.18.0follow-redirects^1.16.0ip-address^10.1.1socks@2.8.7js-yaml@^4.0.0^4.1.1@modyfi/vite-plugin-yaml. Scoped to 4.x line — js-yaml@3.14.2 (istanbul tooling) is unaffected and stayspostcss^8.5.10postcss: 8.5.15Updated
axios^1.13.5^1.15.21.14.0was resolving inside the old rangebasic-ftp^5.2.0^5.2.25.2.0was resolving inside the old rangesysteminformation^5.31.0^5.31.65.31.5was resolving inside the old rangeRemoved (no parent in the current tree declares these; not blocking any vulnerable version — verified via
pnpm why+node_modules/.pnpm/inventory)@isaacs/brace-expansion^5.0.1node_modules/.pnpm/; no parent declares itgot14.5.0node_modules/.pnpm/; no parent declares ittar^7.5.11node_modules/.pnpm/; no parent declares itKept — all other existing overrides remain (
@babel/preset-env,core-js-compat,flatted,glob-parent,handlebars,immutable,jest-environment-node,json5,lodash,lodash-es,minimatch,path-to-regexp@*,picomatch@*,react-from-dom,rollup@*,svgo,tar-fs@*,trim@0.0.1, plus the@types/*and@typescript-eslint/*compatibility pins). Each was verified still active bypnpm whyresolving against a parent in the current tree.🔄 Superseded Dependabot PRs
None — Dependabot did not have any open PRs for these alerts (
gh pr list --search "author:app/dependabot"returned an empty list).✅ Validation
pnpm lintpnpm lint:publintpnpm typecheckpnpm buildpnpm testpnpm test:bundlepnpm lint:csslint:csswas removed from CI in March 2023 (commitcb0a75647, "ci: disable stylelint"); the same 19 stylelint failures exist onmain. Out of scope for this PR.📋 Review Checklist
package.jsonedits required (overrides are the right knob)git log -S "<override>"if curious about original intent@commercetools-uikit/*package gains a vulnerable dep at runtime