Repository navigation
chore(deps): security maintenance and CI/deploy hygiene - #40
Merged
Merged
Conversation
- regenerate bun.lock so all deps resolve to their latest in-range patched versions (bun audit: 236 -> 4 advisories, none fixable) incl. next 16.4.2, express/proxy-addr, hono, axios, devalue, undici - bump vitest to ^4.1.11 everywhere (client was on 2.x pulling in vulnerable tinypool/vite 5); override uuid to ^11.1.1 for exceljs - add bunfig.toml pinning the hoisted linker (Bun 1.3 defaults fresh lockfiles to isolated, which breaks shared type resolution) - actions/checkout v4 -> v5 (Node 20 runtime deprecation) - make the Fly.io deploy opt-in via vars.ENABLE_FLY_DEPLOY; it had no FLY_API_TOKEN and failed on every push (backend deploys via Koyeb) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reviewer's GuideThis maintenance PR refreshes the Bun lockfile to substantially reduce dependency advisories while preserving in-range and workspace-compatible versions, standardizes Vitest and transitive uuid resolution, and pins Bun’s hoisted install layout. It also updates checkout actions and prevents unconfigured Fly.io deployments from failing every push; no runtime API or intentional major-version changes are introduced. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 7 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues
Fixed security issues:
- @hono/node-server (link)
- @modelcontextprotocol/sdk (link)
- axios (link)
- brace-expansion (link)
- browserslist (link)
- devalue (link)
- elysia (link)
- express-rate-limit (link)
- follow-redirects (link)
- form-data (link)
- ip-address (link)
- js-yaml (link)
- minimatch (link)
- nanoid (link)
- next (link)
- path-to-regexp (link)
- picomatch (link)
- postcss (link)
- proxy-addr (link)
- react-router (link)
- source-map-js (link)
- tmp (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/deploy-hono.yml" line_range="19-20" />
<code_context>
env:
DATABASE_URL: postgres://tablecraft:tablecraft@localhost:5432/tablecraft_test
steps:
</code_context>
<issue_to_address>
**Fly credentials reach third-party actions**
When the Fly deploy job runs with `FLY_API_TOKEN` configured, `setup-flyctl` inherits the job-level token and can exfiltrate it, enabling unauthorized Fly.io deployments.
Move `FLY_API_TOKEN` from job-level `env` to only the deploy step's `env`.
</issue_to_address>
### Comment 2
<location path="package.json" line_range="20" />
<code_context>
"@types/react": "^19.2.13"
+ },
+ "overrides": {
+ "uuid": "^11.1.1"
}
}
</code_context>
<issue_to_address>
**UUID override remains vulnerable**
When a consumer reaches one of the affected UUID functions with a custom buffer, `uuid@11.1.1` remains below the fixed version cited for GHSA-w5hq-g745-h8pq. When a caller uses `uuid.v3()`, `uuid.v5()`, or `uuid.v6()` with a custom buffer, the missing bounds check permits out-of-bounds writes, so the dependency override does not fully remove this advisory.
Use a release at or above the advisory’s fixed version if compatible, or otherwise avoid claiming this override clears the advisory and mitigate the vulnerable path.
</issue_to_address>
### Comment 3
<location path="bunfig.toml" line_range="1" />
<code_context>
+[install]
+# Keep the hoisted node_modules layout the workspace packages rely on for
+# shared type definitions (Bun 1.3 defaults fresh lockfiles to "isolated").
</code_context>
<issue_to_address>
**Configuration-only pushes skip deployment**
When a push changes only `bunfig.toml`, the Fly workflow path filter does not match, so no deployment starts and the production app keeps the previous configuration.
Add `bunfig.toml` to the Fly workflow's path filters.
Also at `bunfig.toml:4`.
</issue_to_address>Sourcery assessment
Approval pending. 3 findings to address first.
Blocking findings: .github/workflows/deploy-hono.yml:20, package.json:20, bunfig.toml:1
| "@types/react": "^19.2.13" | ||
| }, | ||
| "overrides": { | ||
| "uuid": "^11.1.1" |
There was a problem hiding this comment.
🟡 Medium · UUID override remains vulnerable
When a consumer reaches one of the affected UUID functions with a custom buffer, uuid@11.1.1 remains below the fixed version cited for GHSA-w5hq-g745-h8pq. When a caller uses uuid.v3(), uuid.v5(), or uuid.v6() with a custom buffer, the missing bounds check permits out-of-bounds writes, so the dependency override does not fully remove this advisory.
Use a release at or above the advisory’s fixed version if compatible, or otherwise avoid claiming this override clears the advisory and mitigate the vulnerable path.
Prompt for AI agents
In `package.json` at line 20:
**UUID override remains vulnerable**
When a consumer reaches one of the affected UUID functions with a custom buffer, `uuid@11.1.1` remains below the fixed version cited for GHSA-w5hq-g745-h8pq. When a caller uses `uuid.v3()`, `uuid.v5()`, or `uuid.v6()` with a custom buffer, the missing bounds check permits out-of-bounds writes, so the dependency override does not fully remove this advisory.
Use a release at or above the advisory’s fixed version if compatible, or otherwise avoid claiming this override clears the advisory and mitigate the vulnerable path.Vercel's install rejected the configVersion 1 lockfile/bunfig combo; configVersion 0 is the format main already deploys with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bun.lockso every dependency resolves to its latest in-range patched version.bun auditgoes from 236 advisories (6 critical, 100 high) to 4. The remaining 4 have no safe fix: braces has no patched release, esbuild's issue only affects dev servers, and cookie's is low severity.^4.1.11in all workspaces.@tablecraft/clientwas still on vitest 2.x, which pulled in vulnerable tinypool and Vite 5.overridespins uuid^11.1.1, which exceljs uses transitively.configVersion: 0(hoisted layout). Bun 1.3 gives a freshly created lockfile the isolated layout by default, which breaks shared type resolution and the Vercel install.actions/checkout@v5replaces v4, which ran on the deprecated Node 20 runtime.vars.ENABLE_FLY_DEPLOY == 'true'). TheFLY_API_TOKENsecret was never set, so the job failed on every push. The backend deploys through Koyeb.No runtime API changes and no major-version upgrades. Breaking upgrades such as zod 4 and react-table 9 are left out on purpose, because many downstream teams depend on these packages.
Validation (local, Node 22 + Bun 1.3.14, mirroring CI)
bun install --frozen-lockfile✅bun run typecheck✅bun run test: engine 377, table 120, adapter-sveltekit 26, client 19, plus all other packages ✅bun run build(all packages and apps) ✅🤖 Generated with Claude Code
Summary by Sourcery
Harden dependency and automation maintenance while keeping deployments and CI reliable without changing runtime APIs.
Bug Fixes:
Enhancements:
Build:
CI:
Deployment: