Skip to content

fix: address open Dependabot security alerts - #128

Open
cbullinger wants to merge 2 commits into
mainfrom
security/fix-js-yaml-fast-uri-vulnerabilities
Open

fix: address open Dependabot security alerts#128
cbullinger wants to merge 2 commits into
mainfrom
security/fix-js-yaml-fast-uri-vulnerabilities

Conversation

@cbullinger

@cbullinger cbullinger commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

This PR upgrades vulnerable transitive dependencies to address all 12 open Dependabot security alerts on main.

Changes

JavaScript (frameworks/javascript/tanstack)

Package Override Lockfile change Via
fast-uri >=3.1.4 3.1.2 → 4.1.1 ajv / bluehawk
js-yaml >=5.2.2 5.2.1 → 5.2.2 xmlbuilder2
postcss >=8.5.18 8.5.15 → 8.5.25 transitive
undici >=8.9.0 8.5.0 → 8.10.0 jsdom

Python (mflix/server/python-fastapi)

Package Constraint Lockfile change
aiohttp >=3.14.3 3.14.1 → 3.14.3

Security Issues Addressed

High Severity

Medium Severity

Dependabot Alerts Resolved

Closes #117, #118, #119, #120, #121, #122, #123, #124, #125, #126, #127, #128

Test Plan

  • npm audit reports 0 vulnerabilities in tanstack app and bluehawk package
  • Lockfiles reflect patched versions for all affected packages
  • requirements.txt regenerated with aiohttp >=3.14.3
  • CI passes
  • No breaking changes in application functionality

cbullinger and others added 2 commits July 29, 2026 13:24
@cbullinger @cursoragent
fix: upgrade js-yaml and fast-uri to address security vulnerabilities
005283f 
Raise npm overrides for js-yaml (>=5.2.2) and fast-uri (>=3.1.4) to
resolve 3 open Dependabot alerts (#117-#119).

Co-authored-by: Cursor <cursoragent@cursor.com>
@cbullinger @cursoragent
fix: upgrade aiohttp, postcss, and undici for new Dependabot alerts
c7fcc32 
Raise aiohttp to >=3.14.3, postcss to >=8.5.18, and undici to >=8.9.0
to address Dependabot alerts #120-#128.

Co-authored-by: Cursor <cursoragent@cursor.com>
@cbullinger cbullinger changed the title fix: upgrade js-yaml and fast-uri to address security vulnerabilities fix: address open Dependabot security alerts Aug 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cbullinger