Repository navigation
chore(deps): bump the production-dependencies group across 1 directory with 19 updates - #95
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…y with 19 updates Bumps the production-dependencies group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [chokidar](https://github.com/paulmillr/chokidar) | `5.0.0` | `6.0.0` | | [esbuild-sass-plugin](https://github.com/glromeo/esbuild-sass-plugin) | `3.6.0` | `3.7.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.5.0` | | [mdast-util-find-and-replace](https://github.com/syntax-tree/mdast-util-find-and-replace) | `3.0.2` | `3.0.4` | | [pixi.js](https://github.com/pixijs/pixijs) | `8.21.0` | `8.22.0` | | [preact](https://github.com/preactjs/preact) | `10.29.8` | `11.0.2` | | [preact-render-to-string](https://github.com/preactjs/preact-render-to-string) | `6.7.0` | `6.8.1` | | [pretty-bytes](https://github.com/sindresorhus/pretty-bytes) | `7.1.3` | `7.2.0` | | [satori](https://github.com/vercel/satori) | `0.19.1` | `0.63.2` | | [sharp](https://github.com/lovell/sharp) | `0.35.4` | `0.35.5` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.4.3` | `4.5.0` | | [toml](https://github.com/BinaryMuse/toml-node) | `5.0.0` | `5.0.1` | | [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` | | [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.5` | | [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.2` | `0.27.7` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.10` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `chokidar` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/paulmillr/chokidar/releases) - [Changelog](https://github.com/paulmillr/chokidar/blob/main/CHANGELOG.md) - [Commits](paulmillr/chokidar@5.0.0...6.0.0) Updates `esbuild-sass-plugin` from 3.6.0 to 3.7.0 - [Release notes](https://github.com/glromeo/esbuild-sass-plugin/releases) - [Commits](https://github.com/glromeo/esbuild-sass-plugin/commits/v3.7.0) Updates `js-yaml` from 5.4.2 to 5.5.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.4.2...5.5.0) Updates `mdast-util-find-and-replace` from 3.0.2 to 3.0.4 - [Release notes](https://github.com/syntax-tree/mdast-util-find-and-replace/releases) - [Commits](syntax-tree/mdast-util-find-and-replace@3.0.2...3.0.4) Updates `pixi.js` from 8.21.0 to 8.22.0 - [Release notes](https://github.com/pixijs/pixijs/releases) - [Commits](pixijs/pixijs@v8.21.0...v8.22.0) Updates `preact` from 10.29.8 to 11.0.2 - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.29.8...11.0.2) Updates `preact-render-to-string` from 6.7.0 to 6.8.1 - [Release notes](https://github.com/preactjs/preact-render-to-string/releases) - [Changelog](https://github.com/preactjs/preact-render-to-string/blob/main/CHANGELOG.md) - [Commits](preactjs/preact-render-to-string@v6.7.0...v6.8.1) Updates `pretty-bytes` from 7.1.3 to 7.2.0 - [Release notes](https://github.com/sindresorhus/pretty-bytes/releases) - [Commits](sindresorhus/pretty-bytes@v7.1.3...v7.2.0) Updates `satori` from 0.19.1 to 0.63.2 - [Release notes](https://github.com/vercel/satori/releases) - [Commits](vercel/satori@0.19.1...0.63.2) Updates `sharp` from 0.35.4 to 0.35.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) Updates `shiki` from 4.4.3 to 4.5.0 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/shiki) Updates `toml` from 5.0.0 to 5.0.1 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/main/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v5.0.0...v5.0.1) Updates `unist-util-visit` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/syntax-tree/unist-util-visit/releases) - [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0) Updates `ws` from 8.21.3 to 8.22.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.21.3...8.22.0) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `@types/node` from 26.6.2 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/ws` from 8.18.1 to 8.18.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws) Updates `esbuild` from 0.27.2 to 0.27.7 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.27.2...v0.27.7) Updates `prettier` from 3.8.1 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.9.10) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: chokidar dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: esbuild-sass-plugin dependency-version: 3.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: js-yaml dependency-version: 5.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: mdast-util-find-and-replace dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pixi.js dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: preact dependency-version: 11.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: preact-render-to-string dependency-version: 6.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pretty-bytes dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: satori dependency-version: 0.63.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: sharp dependency-version: 0.35.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: shiki dependency-version: 4.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: toml dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: unist-util-visit dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: ws dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/ws" dependency-version: 8.18.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: esbuild dependency-version: 0.27.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Review these changes at https://app.gitnotebooks.com/LAF-US/THE-GEMSTONE/pull/95 |
|
The files' contents are under analysis for test generation. |
|
Review changes with |
|
🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews. |
![gitginie[bot]](https://avatars.githubusercontent.com/in/712912?s=60&v=4){kind=small}
There was a problem hiding this comment.
@dependabot[bot]
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
|
We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
✅ Precogs scan complete — No security issues foundCommit
✅ Passed checks (3)
💬 Precogs.ai · Detect. Fix. Merge. |
🔍 CodeRifts / issuerNo OpenAPI schemas found in this repository. This App's check is While no schema is found, this check completes neutral, which GitHub treats as non-blocking — so if CodeRifts is a required status check, it is not currently blocking anything on this branch. To get started, either:
schema:
- path/to/your/openapi.yaml📖 Documentation · 💬 Get help ☁️ You're on the Free plan. Everything is included during the public beta, at no cost and with nothing to upgrade. |
✅ SEO Review - no issues introduced by this PRThis PR introduces no SEO issues. 20 pre-existing issues on 📋 20 pre-existing issues on `main` - not from this PR (🔴 5 · 🟡 7 · 🔵 8)🔴 Critical (5)
🟡 Warnings (7)
🔵 Info (8)
✅ 915 checks passed
SEOCode · Docs & troubleshooting
|
![inspect-review[bot]](https://avatars.githubusercontent.com/in/3177512?s=60&v=4){kind=small}
There was a problem hiding this comment.
inspect review
Triage: 2 entities analyzed | 0 critical, 0 high, 2 medium, 0 low
Verdict: standard_review
Findings (0)
Reviewed by inspect | Entity-level triage found 0 high-risk changes
|
Invalid command format To invoke the bot, use: Available commands:
|
QWED Security Verification Report2 files scanned | 0 blocked | 0 warnings | 0 info | 0 suppressed | 2 verified Engines
Verified Files
Verified by QWED — deterministic security verification. No LLM used. Verification Context v1.0{
"spec_version": "1.0",
"object": {
"formal_statement": "LAF-US/THE-GEMSTONE@ae72b5fe (PR #95) is safe to merge"
},
"context": {
"interpretation": {
"theory": "deterministic security verification",
"logic": "evidence-context-policy pipeline"
},
"proof": {
"verifier": "QWED Security",
"verifier_version": "qwed-security-ruleset/14",
"configuration": {
"repo": "LAF-US/THE-GEMSTONE",
"head_sha": "ae72b5fec1d7a496a5f1d3920cd7a3253068ab52",
"files_scanned": 2
},
"theory_scope": "PR security scan against QWED deterministic rule set",
"trusted_dependencies": [
"qwed-security"
],
"outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
},
"evidence": {
"evidence": {
"status": "VERIFIED",
"agent_message": "VERIFIED against the QWED deterministic rule set: no security boundary violations detected in the scanned files. This attests to the absence of known-pattern violations for this rule set and commit \u2014 it is not a guarantee that the code is free of all vulnerabilities.",
"developer_fields": {
"total_findings": 0,
"advisory_checks": []
},
"is_authoritative": true,
"proof_ref": "sha256:c5005a744a118c37b8e94a8ca699cea368acf944c417620cc204f640fae81ebd",
"scan_evidence": {
"repo": "LAF-US/THE-GEMSTONE",
"head_sha": "ae72b5fec1d7a496a5f1d3920cd7a3253068ab52",
"pr_number": 95,
"files_scanned": 2,
"engine_results": 5,
"conclusion": "success",
"rule_set": "qwed-security-ruleset/14",
"engines": [
"dependency_scan",
"entropy_scan",
"lockfile_scan",
"pattern_scan",
"secret_scan"
]
},
"repo": "LAF-US/THE-GEMSTONE",
"head_sha": "ae72b5fec1d7a496a5f1d3920cd7a3253068ab52",
"files_scanned": 2
},
"proof_ref": "sha256:9463ebe3431266ab9582e1e1bd6f6a8851132499445f6c9af2aa428174067272"
},
"decision": {
"admission": "ADMIT"
}
},
"verdict": "VERIFIED"
}Attestation (signed, binds the Verification Context above){
"envelope": "qwed-security-attestation/1",
"token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjU2NWFkMDg2NGY3NWJkYmIiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiIyNzU5NTA0IiwiYXVkIjoicXdlZC1hdHRlc3RhdGlvbiIsImlhdCI6MTc5MzMzNTUyMCwiZXhwIjoxNzkzMzM1ODIwLCJxd2VkIjp7InJlc3VsdCI6eyJzdGF0dXMiOiJWRVJJRklFRCIsImFnZW50X21lc3NhZ2UiOiJWRVJJRklFRCBhZ2FpbnN0IHRoZSBRV0VEIGRldGVybWluaXN0aWMgcnVsZSBzZXQ6IG5vIHNlY3VyaXR5IGJvdW5kYXJ5IHZpb2xhdGlvbnMgZGV0ZWN0ZWQgaW4gdGhlIHNjYW5uZWQgZmlsZXMuIFRoaXMgYXR0ZXN0cyB0byB0aGUgYWJzZW5jZSBvZiBrbm93bi1wYXR0ZXJuIHZpb2xhdGlvbnMgZm9yIHRoaXMgcnVsZSBzZXQgYW5kIGNvbW1pdCBcdTIwMTQgaXQgaXMgbm90IGEgZ3VhcmFudGVlIHRoYXQgdGhlIGNvZGUgaXMgZnJlZSBvZiBhbGwgdnVsbmVyYWJpbGl0aWVzLiIsImlzX2F1dGhvcml0YXRpdmUiOnRydWV9LCJwcm9vZl9oYXNoIjoic2hhMjU2OmM1MDA1YTc0NGExMThjMzdiOGU5NGE4Y2E2OTljZWEzNjhhY2Y5NDRjNDE3NjIwY2MyMDRmNjQwZmFlODFlYmQiLCJib3VuZGFyeSI6bnVsbCwiZW52ZWxvcGUiOiJxd2VkLXNlY3VyaXR5LWF0dGVzdGF0aW9uLzEiLCJqdGkiOiJmODY3YTk5ZWNlMThlYzliY2MwOTA1NTBhYjE2NzAzYiIsInZlcmlmaWNhdGlvbl9jb250ZXh0Ijp7InNwZWNfdmVyc2lvbiI6IjEuMCIsImZvcm1hbF9zdGF0ZW1lbnQiOiJMQUYtVVMvVEhFLUdFTVNUT05FQGFlNzJiNWZlIChQUiAjOTUpIGlzIHNhZmUgdG8gbWVyZ2UiLCJ2ZXJkaWN0IjoiVkVSSUZJRUQiLCJhZG1pc3Npb24iOiJBRE1JVCIsInZlcmlmaWVyIjoiUVdFRCBTZWN1cml0eSIsInZlcmlmaWVyX3ZlcnNpb24iOiJxd2VkLXNlY3VyaXR5LXJ1bGVzZXQvMTQiLCJwcm9vZl9yZWYiOiJzaGEyNTY6OTQ2M2ViZTM0MzEyNjZhYjk1ODJlMWUxYmQ2ZjZhODg1MTEzMjQ5OTQ0NWY2YzlhZjJhYTQyODE3NDA2NzI3MiJ9fX0.k705CLX6ArIoV2-QOuvWFeBjor5OGvYV98o0EisFSsRWGN-BuAVaTJfN_4Woirl4nSkYT7KbFocnoAdalTn6T3DsIqEGPdwF8SgFrPzG5AuPZ0BtXBOLbcibM5V5UNPLMD7AKmbgNTiimBJT4xKkC_EFzKXvfVKK1ZUVmx0gcGBvBsmha7f0yj_FaTe9L84gPhgr8c2hDcu_mft1wz1Wt6HIy9f8LNcoZq27ttK90rqZDPK4DbJiGkQ90ETFT7ZQ2zLTcmSiBNZn-ih0t8nk-Pdg7-JN2-u9AyzSizB_Ki19Qvc-ZxYDf4f05G0IpEAkQHvm7lroz0KcuxCZ9iX1KQ",
"fingerprint": "c99b988d80ace44f",
"jwks_url": "https://qwed-security-334760594829.us-central1.run.app/.well-known/jwks.json",
"kid": "565ad0864f75bdbb"
} |
Sieve Security Scan ✅No likely vulnerabilities found in changed files. 0 real · 0 suppressed · 0 FP · 0 total |
![secuarden-ai[bot]](https://avatars.githubusercontent.com/in/1232245?s=60&v=4){kind=small}
| "remark-smartypants": "^3.0.3", | ||
| "rfdc": "^1.4.1", | ||
| "satori": "^0.19.1", | ||
| "satori": "^0.63.2", |
There was a problem hiding this comment.
⚠️ High: Suspicious major version jump in satori dependency
🎟️ Issue Explanation
The satori package version jumps from ^0.19.1 to ^0.63.2 — a leap of 44 minor versions. This is an unusually large version bump that does not follow normal semver progression for a package in the 0.x range. This pattern can indicate a dependency confusion or package takeover attack where a malicious actor publishes a high version to hijack projects using wide version ranges. The package is used in a public repository with payment and auth risk tags, increasing blast radius if a malicious build artifact is introduced.
🛠️ Actions
@secuarden-ai /fix- Generate remediation code for this issue@secuarden-ai /explain- Learn why this matters and potential impact@secuarden-ai /ignore [reason]- Dismiss this finding@secuarden-ai /review- Submit a reasoned assessment and request a rescan
🔐 Secuarden Security Review • Finding: SEC_9ff94012f077
| "prettier": "^3.9.10", | ||
| "tsx": "^4.23.15", | ||
| "typescript": "^5.9.3" | ||
| "typescript": "^7.0.2" |
There was a problem hiding this comment.
🟡 Medium: Suspicious major version jump in TypeScript devDependency
🎟️ Issue Explanation
TypeScript jumps from ^5.9.3 to ^7.0.2. As of the last known public release data, TypeScript 7.x does not exist in the official Microsoft/TypeScript npm registry. This could indicate a dependency confusion attack or a typosquatted/hijacked package. While TypeScript is a devDependency and does not ship to production directly, malicious code in a build tool can exfiltrate secrets from the CI/CD environment (e.g., npm tokens, cloud credentials) or inject backdoors into build output. The repository context flags CI/CD secrets as a risk area.
🛠️ Actions
@secuarden-ai /fix- Generate remediation code for this issue@secuarden-ai /explain- Learn why this matters and potential impact@secuarden-ai /ignore [reason]- Dismiss this finding@secuarden-ai /review- Submit a reasoned assessment and request a rescan
🔐 Secuarden Security Review • Finding: SEC_6b6323f1ccaf
| "preact-render-to-string": "^6.7.0", | ||
| "pretty-bytes": "^7.1.3", | ||
| "pixi.js": "^8.22.0", | ||
| "preact": "^11.0.2", |
There was a problem hiding this comment.
🟡 Medium: Major version bump in preact with potential breaking security changes
🎟️ Issue Explanation
preact jumps from ^10.29.8 to ^11.0.2. A major version bump (v10 → v11) can introduce breaking changes in how content is sanitized or how XSS protections are applied in the virtual DOM. If this version exists and contains regressions in escaping or sanitization, it could introduce XSS vulnerabilities in the rendered frontend. The companion package preact-render-to-string also bumps accordingly (^6.7.0 → ^6.8.1), which handles server-side rendering where improper escaping is a known XSS attack vector.
🛠️ Actions
@secuarden-ai /fix- Generate remediation code for this issue@secuarden-ai /explain- Learn why this matters and potential impact@secuarden-ai /ignore [reason]- Dismiss this finding@secuarden-ai /review- Submit a reasoned assessment and request a rescan
🔐 Secuarden Security Review • Finding: SEC_285e5e4b6bf3
| "prettier": "^3.9.10", | ||
| "tsx": "^4.23.15", | ||
| "typescript": "^5.9.3" | ||
| "typescript": "^7.0.2" |
There was a problem hiding this comment.
🟡 Medium: Unverified Major Version Bump – TypeScript 7.x
🎟️ Issue Explanation
The version constraint is bumped from ^5.9.x to ^7.0.2, skipping the entire 6.x line. TypeScript 7 (as of the last public information) is not a stable, generally-available release. Pinning to a non-stable or pre-release major version via a caret range means the build toolchain will resolve to early/unstable releases that may contain unvetted changes, breaking type-safety guarantees relied upon by the rest of the security-sensitive codebase (auth, payment paths flagged in repo context). An adversary with access to the npm registry could also exploit the wider resolution window introduced by jumping two major versions.
🛠️ Actions
@secuarden-ai /fix- Generate remediation code for this issue@secuarden-ai /explain- Learn why this matters and potential impact@secuarden-ai /ignore [reason]- Dismiss this finding@secuarden-ai /review- Submit a reasoned assessment and request a rescan
🔐 Secuarden Security Review • Finding: SEC_17be087e0431
| "remark-smartypants": "^3.0.3", | ||
| "rfdc": "^1.4.1", | ||
| "satori": "^0.19.1", | ||
| "satori": "^0.63.2", |
There was a problem hiding this comment.
🟡 Medium: Extremely Large Major Version Jump – satori ^0.19.1 → ^0.63.2
🎟️ Issue Explanation
The satori dependency jumps from ^0.19.1 to ^0.63.2, spanning 44 minor/major pre-1.0 versions. For a 0.x package each minor bump is technically breaking per semver convention. This extremely large range of skipped versions makes it impractical to audit changelog entries for security-relevant changes (e.g., SVG/font parsing vulnerabilities, prototype pollution). The caret on a 0.x package resolves only patch updates, but the explicit target 0.63.2 vs 0.19.1 represents a deliberate leap that warrants security review of all intermediate releases.
🛠️ Actions
@secuarden-ai /fix- Generate remediation code for this issue@secuarden-ai /explain- Learn why this matters and potential impact@secuarden-ai /ignore [reason]- Dismiss this finding@secuarden-ai /review- Submit a reasoned assessment and request a rescan
🔐 Secuarden Security Review • Finding: SEC_6d0c19e44988
| "preact-render-to-string": "^6.7.0", | ||
| "pretty-bytes": "^7.1.3", | ||
| "pixi.js": "^8.22.0", | ||
| "preact": "^11.0.2", |
There was a problem hiding this comment.
🟢 Low: Major Version Bump – preact ^10.x → ^11.0.2
🎟️ Issue Explanation
Preact is bumped from ^10.29.8 to ^11.0.2, a new major version. The caret range will resolve to any 11.x release going forward, meaning future npm installs without a lockfile commit can pull in untested 11.x patch/minor releases. Given the repo uses preact-render-to-string for server-side rendering (line 66), regressions in HTML serialization or XSS sanitization behavior in the new major should be validated.
🛠️ Actions
@secuarden-ai /fix- Generate remediation code for this issue@secuarden-ai /explain- Learn why this matters and potential impact@secuarden-ai /ignore [reason]- Dismiss this finding@secuarden-ai /review- Submit a reasoned assessment and request a rescan
🔐 Secuarden Security Review • Finding: SEC_51d374951f92
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| Security | 1 medium 1 high |
🟢 Metrics 0 complexity · 0 duplication
Metric Results Complexity 0 Duplication 0
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — Blocking issues found
TypeScript 7 breaks npm run check; required typecheck fails before tests run.
Exact-head CI remains unresolved (3 failed, 1 action required, 1 pending); no CI-dependent merge-safety claim is made.
Owner action: Migrate tsconfig.json to a TypeScript 7-supported resolution mode (for example bundler, or a compatible node16/nodenext pairing), or keep TypeScript on 5.x until that migration is complete; then rerun npm run check and npm test.
2 further items in details.
Risk path
The TypeScript 7 bump turns the existing moduleResolution: "node" config into a hard typecheck failure that stops CI before any test runs.
sequenceDiagram
participant PR as PR bump
participant CI as CI test job
participant TSC as tsc --noEmit
participant T as npm test
PR->>CI: npm ci
CI->>TSC: npm run check
note over TSC: PR change — TypeScript ^7.0.2 installed
critical TS 7 rejects removed moduleResolution=node10
TSC-->>CI: error TS5108 in tsconfig.json
end
CI-->>T: test step never runs
note over CI,T: Impact — required typecheck fails#59; PR cannot be validated
TSC-->>CI: fix config or stay on TS 5.x, then rerun
Review details and evidence
| Priority | File | Finding | Evidence |
|---|---|---|---|
| P1 | package.json |
TypeScript 7 breaks npm run check; required typecheck fails before tests run. |
confirmed |
| P2 | package.json |
Chokidar 6 requires Node >=22.22 but package.json still declares >=22. |
confirmed |
Finding details
P1 · TypeScript 7 breaks npm run check; required typecheck fails before tests run.
package.json
Changed mechanism. package.json moves typescript from ^5.9.3 to ^7.0.2, and the lockfile resolves typescript@7.0.2. TypeScript 7 removed the legacy node10 resolution mode.
Reachable path. .github/workflows/test.yml runs npm ci, then npm run check, which is tsc --noEmit && npx prettier. --check. tsconfig.json still contains:
"module": "esnext",
"target": "esnext",
"moduleResolution": "node",The PR-head test job fails at that exact step:
tsconfig.json(7,25): error TS5108: Option 'moduleResolution=node10' has been removed. Please remove it from your configuration.
Consequence. The required typecheck fails; npm test never runs; the PR cannot be validated or merged as-is.
Strongest counterevidence. The tsconfig.json line is unchanged, so the delta is the compiler version, not a pre-existing TS 7 configuration. npm ci succeeded, so this is not an install-time dependency-resolution failure. The base used TypeScript 5.9.3, so there is no base-side TS 7 failure to attribute this to.
Verification boundary: confirmed; scope: changed region.
Material unknowns
- Whether
quartz/util/og.tsxcontains additional Satori 0.63 contract dependencies beyond the exactsatori(imageComponent, { width, height, fonts, loadAdditionalAsset })call anchored inquartz/plugins/emitters/ogImage.tsx. Any additional Satori contract in that file would be a coverage gap in the major upgrade assessment, not a demonstrated defect; the current blocking posture is unchanged.- Check: Inspect
quartz/util/og.tsxfor Satori 0.63 contract usage and exercise an OG-image render.
- Check: Inspect
LlamaPReview checks
- Read the complete PR-head file
tsconfig.json. - Read the complete PR-head file
package.json. - Read the complete PR-head file
.github/workflows/test.yml. - Read bounded PR-head context from
package-lock.json. - Read bounded PR-head context from
quartz/plugins/emitters/ogImage.tsx. - Inspected matching PR-head repository snippets in
quartz/build.ts,quartz/cli/handlers.js.
Still coding alone? Open CarbonChat, a chat room right inside Codex.
| "ansi-truncate": "^1.4.0", | ||
| "async-mutex": "^0.5.0", | ||
| "chokidar": "^5.0.0", | ||
| "chokidar": "^6.0.0", |
There was a problem hiding this comment.
P2 | Confidence: High
Changed mechanism. package.json moves chokidar from ^5.0.0 to ^6.0.0. The lockfile entry for chokidar@6.0.0 declares engines.node: ">= 22.22", while package.json still declares:
"engines": {
"npm": ">=10.9.2",
"node": ">=22"
}Reachable path. quartz/build.ts calls chokidar.watch(...) in the normal build/serve path. A developer or CI environment on Node 22.0–22.21 satisfies the project's declared engine but is outside Chokidar 6's supported range.
Consequence. npm ci can emit EBADENGINE or fail under engine-strict settings, and the runtime combination is unsupported by the dependency. The current workflow uses node-version: 22 and its npm ci step succeeded, so this is not the observed CI failure; it is a manifest support-contract defect introduced by the bump.
Strongest counterevidence. setup-node with node-version: 22 likely resolves a recent 22.x release, so the current CI run may not exercise the lower end of the declared range. No current Chokidar runtime crash is shown.
Owner action: Raise engines.node to >=22.22 and update any pinned CI image accordingly, or keep chokidar on 5.x.
Evidence: PR-head read of package.json; bounded PR-head context from package-lock.json; PR-head read of .github/workflows/test.yml.
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/production-dependencies-bdf9bca0db
branch
November 6, 2026 04:44
There was a problem hiding this comment.
@dependabot[bot]
Thank you for your contribution to this repository! We appreciate your effort in closing pull request.
Happy coding!
Pull Request Summary by devActivityMetrics
null |
|
Invalid command format To invoke the bot, use: Available commands:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the production-dependencies group with 19 updates in the / directory:
5.0.06.0.03.6.03.7.05.4.25.5.03.0.23.0.48.21.08.22.010.29.811.0.26.7.06.8.17.1.37.2.00.19.10.63.20.35.40.35.54.4.34.5.05.0.05.0.15.1.05.2.08.21.38.22.08.18.18.18.226.6.226.6.58.18.18.18.20.27.20.27.73.8.13.9.105.9.37.0.2Updates
chokidarfrom 5.0.0 to 6.0.0Release notes
Sourced from chokidar's releases.
... (truncated)
Changelog
Sourced from chokidar's changelog.
... (truncated)
Commits
4130839Release 6.0.0.53f3256Bump devdeps11ad48fMore fixesb6812ddChange date706ef2cMerge pull request #1492 from paulmillr/jg/private-publicd85f4ccchore: expose tested members97e1b93Add changelog8d5c07dMore v6 fixes7af52dfBump ci release.ymla0b05d9Merge pull request #1478 from paulmillr/jg/sponsorsUpdates
esbuild-sass-pluginfrom 3.6.0 to 3.7.0Release notes
Sourced from esbuild-sass-plugin's releases.
Commits
Updates
js-yamlfrom 5.4.2 to 5.5.0Changelog
Sourced from js-yaml's changelog.
Commits
cb62b2d5.5.0 released87aed90Deps bump3aec511Fix error positions for non-printable characters, #80111aa483Reject flow indicators at the start of block plain scalars, #801339d8e0Refactor tag encoder and decoder to match the YAML specification78326245.4.3 released0cbb471Fix whitespace-only block scalar followed by a less indented line, close #80230108ccParse the first block mapping key once (#800)Updates
mdast-util-find-and-replacefrom 3.0.2 to 3.0.4Release notes
Sourced from mdast-util-find-and-replace's releases.
Commits
fad9bd53.0.4bc5d2a9Add test fortextas a root` nodeb435e6cRemove unneeded@ts-expect-error312079bFix wrong parameter description9b622deFix type in docdbe507aRemove no longer applicable doc comment2870b11Refactor to improve performance6c4850c3.0.3a1fc3d3Update output inreadme.mdd65a2adFix merging adjacent text nodesUpdates
pixi.jsfrom 8.21.0 to 8.22.0Release notes
Sourced from pixi.js's releases.
... (truncated)
Commits
5b41ee3v8.22.09dc976dfix: skip the unread-attribute warning when the attribute has a format (#12267)1289ab7docs: correct TilingSprite texture, width and height defaults (#12269)b96fb4efix: nested filters crash after renderer resize (#12257)082128afix: blend filter backdrop when every parent filter is skipped (#12263)f3d96dbfeat: add a federated contextmenu event (#12250)8dbbeb9feat: 3D textures, storage textures and 3D mipmaps (#12248)ef0c0a7feat: sRGB view formats and transient MSAA colour on WebGPU (#12225)27071aafix: integer texture formats on WebGL and WebGPU (#12230)0f8983ffix: declare accessibilityOptions on the public renderer options (#12222)Updates
preactfrom 10.29.8 to 11.0.2Release notes
Sourced from preact's releases.
... (truncated)
Commits
7c23627Merge pull request #5329 from preactjs/release/11.0.2b1fffe611.0.21a07083Merge pull request #5328 from brevin-aq/fix/render-error-duplicate-children8ab86eafix: keep LIS candidacy separate from old vnode matching82d8c66fix: don't leave MATCHED on new vnodes when a child throws1dde7a8fix: correct type of createRef (#5326)74df25eMerge pull request #5319 from preactjs/JoviDeCroock/golf-preact-coreb8e0ad9Or isHydrating into the suspended flags1324976Test newProps !== oldProps first in the cWRP guardba2598aLet setStyle default removed style valuesUpdates
preact-render-to-stringfrom 6.7.0 to 6.8.1Release notes
Sourced from preact-render-to-string's releases.
Changelog
Sourced from preact-render-to-string's changelog.
Commits
0519dc8Merge pull request #483 from preactjs/changeset-release/main7277e10Version Packages75291f2Merge pull request #482 from preactjs/fix/escape-coerced-attribute-valuesa4b9e49fix: encode attribute values after string coercion55804f3Merge pull request #481 from preactjs/fix/release-tag-git-identity085ec2efix: don't create a local git tag when staging a release601e6c8Merge pull request #465 from preactjs/changeset-release/main1c9c381Version Packagesf26bd8cMerge pull request #479 from preactjs/fix/changesets-format3ecaa75Fix Changesets release formattingUpdates
pretty-bytesfrom 7.1.3 to 7.2.0Release notes
Sourced from pretty-bytes's releases.
Commits
a35ed217.2.04e800a3Fix formatting edge cases and validate options1d517bbMeta tweaksUpdates
satorifrom 0.19.1 to 0.63.2Release notes
Sourced from satori's releases.
... (truncated)
Commits
074f0b3fix: Report invalid sizes, insets and margins like other invalid values (#950)e1aa7befix: Honor emoji and text presentation selectors (#948)5a9e32adocs(playground): Use the srcset sources browsers would use in screenshots (#...c66082dfeat: Render selects and their options like Chrome (#947)b9e5af5fix: Render variable fonts as their default instance (#946)f725eddfix: Size SVGs without width and height like browsers (#942)7e8efabfix: Don't make lines of white space between blocks (#945)5ae3a69fix: Hide closed dialogs, and draw open ones like browsers (#944)b46e5adfeat: Render the labels of button inputs (#943)b7e86d9fix: Support -webkit-flex and -webkit-inline-flex (#941)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
sharpfrom 0.35.4 to 0.35.5Release notes
Sourced from sharp's releases.
... (truncated)
Commits
51a990fRelease v0.35.596de105Upgrade to sharp-libvips v1.3.43a61390CI: Configure Dependabot with all package.json locations4940c50Improve gain map support for rotate/flip/flop ops20654aaPrerelease v0.35.5-rc.1ef4f934CI: Upgrade to Ubuntu 26.04358df95Upgrade to libvips v8.18.749f4903Improve gain map support for rotate-then-extract #46060e2e55eSilence a couple of compiler/static analysis warningscef3b8cImprove gain map support for extract operation #4606Updates
shikifrom 4.4.3 to 4.5.0Release notes
Sourced from shiki's releases.