Repository navigation
fix(deps): clear accumulated security advisories and prepare 0.3.1 - #53
Merged
Merged
Conversation
Folds the five open Renovate security PRs into one lockfile change so they land together: hono 4.13.11, zod 4.6.6, dompurify 3.4.17, vite 8.2.4 and vitest 4.1.11. @vitest/coverage-v8 moves to 4.1.11 with vitest, which pins it as an exact peer. A dedupe drops the zod 4.4.3 copy knip and eslint-plugin-react-hooks still held, so no vulnerable zod stays in the lockfile. Adds the 0.3.1 changelog entry.
Bundle ReportChanges will increase total bundle size by 896 bytes (0.05%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: beans-web-web-esmAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
pnpm audit reported 62 advisories, nearly all in transitive tooling the image ships in node_modules. Refreshing each within its dependents' ranges clears them, along with @hono/node-server 2.1.6, vitest and coverage-v8 4.1.12, jsdom 30.1.3 (undici 8.12) and the codegen chain (@graphql-tools/utils 12). Two dev-only advisories have no fix reachable from their dependents and are ignored in pnpm-workspace.yaml with the reasoning: minimatch 10 under ESLint, whose fix in 11 removes the makeRe that eslint-plugin-import-x calls, and zod 3 under @codecov/vite-plugin, which has no patched 3.x. The server's zod is floored at ^4.6.6 so the zod ignore cannot hide a vulnerable copy on the runtime path.
The image scan reported fifteen HIGH findings in the bundled beans binary: Go stdlib CVEs fixed in 1.26.10, and x/net and x/text CVEs fixed in 0.60.0 and 0.41.0. x/net 0.60.0 requires x/text 0.42.0, so that is the pin written down rather than one go get would silently raise. Both declare go 1.26.0 or lower, so the pinned toolchain is still the one that builds them.
ThePrismSystem
changed the title
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies the five open Renovate security updates and clears everything else CI's Audit and Image Scan jobs now report against main, then adds the 0.3.1 changelog entry so the release can be tagged from the merge commit. Supersedes #48, #49, #50, #51 and #52.
Main last passed CI on 2026-08-07. Advisories published since then mean
pnpm auditfound 62 and Trivy found 45 HIGH/CRITICAL on this branch's first run, nearly all in transitive tooling.Changes
@hono/node-serverto 2.1.6, zod to 4.6.6 and dompurify to 3.4.17, the runtime packages@vitest/coverage-v8to 4.1.12 (vitest pins coverage-v8 as an exact peer), and jsdom to 30.1.3, which brings undici 8.12@fastify/busboy, smol-toml and the@graphql-tools/@graphql-codegenchain (utils 11 to 12). Codegen output is unchangedbeansbinary with Go 1.26.10, x/net 0.60.0 and x/text 0.42.0, clearing all 15 HIGH gobinary findings. x/net 0.60.0 requires x/text 0.42.0, so that is the pin written downpnpm-workspace.yaml, each with its reason: minimatch 10 under ESLint (the fix in 11 removesmakeRe, which eslint-plugin-import-x calls) and zod 3 under@codecov/vite-plugin(no patched 3.x; zod 4 drops the one-argumentz.recordthe plugin uses). The server's zod floor goes to^4.6.6so the zod ignore cannot hide a vulnerable copy on the runtime pathReachability
None of the runtime advisories reached this server as written. The closest was
@hono/node-server'sserveStaticdecoding the path twice, which lets a request skip path-scoped middleware. Here it is registered after every API route and serves only the publicweb/distbundle, andsecureHeadersapplies to every path, so nothing protected sat behind it. The others cover hono's ownserveStatic,parseBody()andhono/jsx, zod's length-constrained collections, and DOMPurify'sIN_PLACEmode, none of which this code uses. seroval comes in through TanStack Router but is tree-shaken out of the built bundle.Test Plan
pnpm audit --audit-level moderatepasses (2 ignored, as above)docker buildplustrivy image --severity HIGH,CRITICAL --ignore-unfixedwith.trivyignore: no findingsbeansbinary built by the updatedscripts/build-beans.shpnpm install --frozen-lockfilesucceeds; lockfile stays at v9.0715 unit and integration tests pass, with 98%+ coverage on every workspace. The one unmet peer left (
@codecov/vite-pluginwants vite 6 or older) predates this change, and so does theMaxListenersExceededWarningin the server'sevents.test.tsoutput, which appears the same number of times against main's lockfile.Review Checklist