fix(security): clear all open Dependabot alerts by rishitank · Pull Request #72 · rishitank/holocron

rishitank · 2026-09-25T14:15:22Z

Opened as a draft on purpose. main still has .github/workflows/auto-merge.yml, which runs gh pr merge --auto --squash on every non-draft same-repo PR. It skips drafts. If this PR were opened as ready, it would squash-merge itself once checks passed and threads were resolved, without the owner merging it. #71 removes that workflow. Merge #71 first, then mark this PR ready.

What

This PR clears all 77 open Dependabot alerts (28 high, 45 medium, 4 low), all in package-lock.json, with two package.json changes plus a regenerated lockfile:

vitest and @vitest/coverage-v8: ^3.0.0 → ^4.1.11. This is the only direct bump. It fixes the vitest and @vitest/mocker alerts and pulls vite off 7.3.1. It goes to the latest 4.x rather than 5.x to keep the change minimal. Renovate will propose 5.x as a grouped major.
overrides: { "esbuild": "^0.28.1" }. tsup@8.5.1 is the latest release and still declares esbuild: ^0.27.0, and every 0.27.x falls inside GHSA-g7r4-m6w7-qqqr (chore(deps): bump the dev-dependencies group with 3 updates #59). No direct bump can pull 0.28.1 in, so an override is the only option. vite@8, tsx and bundle-require all accept 0.28. Drop the override once tsup allows 0.28.
Every other alert is a transitive dependency. Each is fixed by moving it to the newest version its parent's existing range already allows. I used npm update --package-lock-only <pkg…>, not overrides. No other package.json ranges change.

Two notable resolutions:

@hono/node-server 1.19.9 → 2.1.1. @modelcontextprotocol/sdk declares ^1.19.9 || ^2.0.5, so npm picked 2.x. holocron does not import hono itself, and the MCP integration tests pass.
vite 7.3.1 → 8.3.1. vitest@4 accepts ^6 || ^7 || ^8.

Every alert and the version that fixes it

Package	Alerts (#, severity, first patched)	Now in lockfile
`@hono/node-server`	#14 H ≥1.19.10, #33 M ≥1.19.13, #105 M ≥1.19.15	2.1.1
`@humanfs/node`	#110 M ≥0.16.8	0.16.8
`@vitest/mocker`	#118 M ≥4.1.11	4.1.11
`body-parser`	#74 L ≥2.3.0	2.3.0
`brace-expansion`	#83 H ≥1.1.16, #84 H ≥2.1.2	1.1.21, 5.0.12 (no 2.x left)
`esbuild`	#59 L ≥0.28.1	0.28.2
`express-rate-limit`	#17 H ≥8.2.2	8.7.0
`fast-uri`	#79 H ≥3.1.3, #80 H ≥3.1.4, #93 H ≥3.1.5, #103 H ≥3.1.2, #104 H ≥3.1.1, #108 H ≥3.1.6, #109 H ≥3.1.6	3.1.8
`find-my-way`	#82 H ≥9.7.0	9.9.0
`flatted`	#21 H ≥3.4.2	3.4.4
`hono`	#3 H ≥4.12.2, #11 M ≥4.12.4, #12 H ≥4.12.4, #13 M ≥4.12.4, #18 M ≥4.12.7, #34 M ≥4.12.12, #35 M ≥4.12.12, #36 M ≥4.12.12, #37 M ≥4.12.12, #38 M ≥4.12.12, #40 M ≥4.12.14, #44 M ≥4.12.16, #45 M ≥4.12.16, #47 M ≥4.12.18, #48 L ≥4.12.18, #49 M ≥4.12.18, #55 M ≥4.12.21, #56 M ≥4.12.21, #57 M ≥4.12.21, #58 M ≥4.12.21, #65 M ≥4.12.25, #66 M ≥4.12.25, #67 H ≥4.12.25, #68 M ≥4.12.25, #69 M ≥4.12.25, #75 M ≥4.12.27, #77 M ≥4.12.27, #78 M ≥4.12.27, #90 M ≥4.12.34, #94 M ≥4.12.34, #95 L ≥4.12.34, #96 M ≥4.12.34, #113 M ≥4.13.5, #114 M ≥4.13.5, #115 M ≥4.13.5	4.13.9
`ip-address`	#43 M ≥10.1.1, #92 H ≥10.3.1	10.7.2
`js-yaml`	#100 H ≥4.3.1, #121 H ≥4.3.2	4.3.2
`minimatch`	#7 H ≥9.0.7	3.1.5, 10.2.6 (no 9.x left)
`nanoid`	#111 H ≥3.3.12	3.3.19
`path-to-regexp`	#26 M ≥8.4.0, #27 H ≥8.4.0	8.4.2
`picomatch`	#23 M ≥4.0.4	4.0.7
`postcss`	#42 M ≥8.5.10, #85 H ≥8.5.12, #86 H ≥8.5.18, #99 M ≥8.5.23	8.5.28
`qs`	#51 M ≥6.15.2, #107 M ≥6.16.0, #112 M ≥6.16.0	6.16.0
`rollup`	#6 H ≥4.59.0	4.63.5
`vite`	#30 H ≥7.3.2, #31 M ≥7.3.2, #32 H ≥7.3.2, #63 M ≥7.3.5, #64 H ≥7.3.5	8.3.1
`vitest`	#119 M ≥4.1.11	4.1.11

I checked the table mechanically: for all 77 alerts, no copy of the package anywhere in the new package-lock.json satisfies the alert's vulnerable_version_range.

How the lockfile was produced

The lockfile is ~270 KB, too big to push through the API, so a temporary workflow (zz-tmp-regen-lockfile.yml, added in 746e3c6 and deleted in e4836fa) regenerated it on this branch. It ran on Node 25 from .nvmrc:

npm install --package-lock-only --ignore-scripts
npm update  --package-lock-only --ignore-scripts hono @hono/node-server fast-uri find-my-way express-rate-limit path-to-regexp ip-address qs body-parser js-yaml postcss brace-expansion nanoid flatted minimatch rollup picomatch @humanfs/node esbuild vite
npm audit --audit-level=low   # gate: fails the job unless clean
npm ci                        # gate: lockfile must install

It committed only package-lock.json (a08fee4, as github-actions[bot]).

I ran the same commands locally with npm 10. The result has identical package versions. The only textual difference is the "libc" fields that npm 11 records.

Verification (local, Node 25.9.0, same lockfile)

npm ci: ✅. The onnxruntime-node postinstall can't download in my sandbox, so I verified with --ignore-scripts. CI installs normally.
npm run lint: ✅ 0 errors. The 22 warnings are the same as on main.
npm run typecheck: ✅.
npm run test:coverage on vitest 4.1.11: ✅ 19 files, 240 tests, all passing. Coverage thresholds are met: 91.3% lines, 78.2% branches (threshold 75). vitest.config.ts needed no changes.
npm run build (tsup on esbuild 0.28.2): ✅. The node:sqlite post-build patch still applies, and node dist/cli/index.js --help runs.
npm audit: ✅ found 0 vulnerabilities.

Risks

vitest 3 → 4 is a major bump for test tooling only. It has no runtime impact, and the whole suite passes unchanged.
esbuild override changes the tsup build toolchain. The build output was checked as described above.
@hono/node-server 2.x is used only inside @modelcontextprotocol/sdk's HTTP transport, and the SDK declares support for it.

What Rishi must do

Merge chore: move dependency updates from Dependabot to Renovate #71 first, which removes the blanket auto-merge workflow. Then mark this PR ready and merge it.
After the merge, Dependabot re-scans and should auto-close all 77 alerts.

🤖 Generated with Claude Code

https://claude.ai/code/session_0171XyyqTUH64gAi1AcerwjN

- vitest / @vitest/coverage-v8 ^3 -> ^4.1.11 (alerts on vitest and @vitest/mocker; also moves vite off 7.3.1) - overrides.esbuild ^0.28.1: tsup@8.5.1 (latest) still declares esbuild ^0.27.0, and every 0.27.x is inside GHSA-g7r4-m6w7-qqqr Adds a temporary workflow that regenerates package-lock.json from this package.json; it is deleted in a follow-up commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0171XyyqTUH64gAi1AcerwjN

Generated by the temporary zz-tmp-regen-lockfile workflow: npm install --package-lock-only, then npm update --package-lock-only of the vulnerable transitive packages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0171XyyqTUH64gAi1AcerwjN

coderabbitai · 2026-09-25T14:15:32Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e0951141-8149-4c49-970b-3db1c859e32c

📥 Commits

Reviewing files that changed from the base of the PR and between e4836fa and 2c39d44.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7e290913-b568-49b8-aedd-bbd884cbc0d9

📥 Commits

Reviewing files that changed from the base of the PR and between 78b6b9a and e4836fa.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (1)

package.json (1)

61-61: 🎯 Functional Correctness

Declare a supported Node.js version, Apprentice.

Vitest 4 and the resolved Vite 8.3.1 require a compatible Node.js version. The project uses .nvmrc in its CI and release workflows, so an older supported Node.js version would make these workflows fail. Update the supported runtime declaration, or retain Vitest 3 if the project must support an older Node.js version.

📝 Summary

Summary by CodeRabbit

Chores
- No changes to features or behaviour visible to end users are included in this release. There are no user-facing updates to announce.

Walkthrough

The package manifest upgrades vitest and @vitest/coverage-v8 to ^4.1.11. It adds an esbuild override at ^0.28.1.

Changes

Test tooling dependencies

Layer / File(s)	Summary
Update test tooling dependencies `package.json`	`vitest` and `@vitest/coverage-v8` now use `^4.1.11`. The package adds an `esbuild` override at `^0.28.1`.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e4836

The test-tooling update is compatible with the repository's inspected runtime and dependency versions, with no identified merge-blocking risk.

Architecture Summary

Architecture risk: 🔵 Low · up to e4836

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in package.json: @vitest/coverage-v8 and vitest now use ^4.1.11 instead of ^3.0.0; the package also adds an esbuild override at ^0.28.1.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: resolving all open Dependabot security alerts.
Description check	✅ Passed	The description directly explains the dependency updates, lockfile regeneration, verification results, risks, and merge sequence. It is fully related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Test tools rise to version four.
Coverage follows through the door.
esbuild receives its pinned range.
The manifest records the change.
The Dark Side builds; the tests take flight.}

_{Comment @coderabbitai help to get the list of available commands.}

rishitank · 2026-09-25T15:31:06Z

@coderabbitai review

coderabbitai · 2026-09-25T15:31:15Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rishitank · 2026-09-25T16:16:55Z

@coderabbitai review

coderabbitai · 2026-09-25T16:17:04Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rishitank · 2026-09-25T16:24:20Z

Reply to the "Additional comment" on package.json:61 (declare a supported Node version).

No change is needed. The supported runtime is already declared and satisfies both tools:

package.json has engines.node: ">=25.0.0", and .nvmrc is 25. CI and release both use .nvmrc.
vitest@4.1.11 and vite@8.3.1 both require node ^20.19.0 || >=22.12.0, which Node 25 satisfies.

On Node 25.9.0, CI on e4836fa passed every job: Lint, Type Check, Test (on vitest 4), Security Audit, CodeQL, Dependency Review and Build. I got the same result locally.

rishitank · 2026-09-25T19:29:09Z

Brought up to date with main using Update branch. The new head is 2c39d44.

What main gained: Renovate's chore(deps): update dependency @modelcontextprotocol/sdk to v1.30.1 #75 (@modelcontextprotocol/sdk 1.30.1). It changes only the lockfile, and Renovate auto-merged it unreviewed.
The textual merge was clean. The merged lockfile is also consistent with this branch's package.json: npm install --package-lock-only on it makes no resolution changes. The only diff is npm 10 vs 11 libc metadata.
The lockfile now resolves:
- @modelcontextprotocol/sdk 1.30.1;
- vitest and @vitest/coverage-v8 4.1.11;
- esbuild ≥0.28.1.
Renovate's chore(deps): update dependency vitest to v4 [security] - autoclosed #74 (vitest to v4 [security]) is superseded by this PR. I've commented there. It's still a draft and still open.

This PR stays a draft until #71 (which removes auto-merge.yml) is merged.

🤖 Generated with Claude Code

rishitank · 2026-09-25T19:29:38Z

@coderabbitai review

coderabbitai · 2026-09-25T19:29:47Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rishitank · 2026-09-25T21:50:56Z

@coderabbitai review

coderabbitai · 2026-09-25T21:51:04Z

⚠️ Action not completed

No files to review.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

rishitank · 2026-10-16T12:25:30Z

This PR has been a draft for more than 24 hours. If it's being reviewed, please mark it ready for review: drafts are for work in progress only, and the review gate already stops anything merging before CodeRabbit approves.

rishitank and others added 3 commits September 25, 2026 15:08

fix(security): regenerate package-lock.json

a08fee4

Generated by the temporary zz-tmp-regen-lockfile workflow: npm install --package-lock-only, then npm update --package-lock-only of the vulnerable transitive packages.

chore: remove temporary lockfile regeneration workflow

e4836fa

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0171XyyqTUH64gAi1AcerwjN

rishitank mentioned this pull request Sep 25, 2026

fix(security): resolve CodeQL findings #73

Draft

coderabbitai Bot approved these changes Sep 25, 2026

View reviewed changes

Merge branch 'main' into fix/dependabot-alerts

2c39d44

rishitank mentioned this pull request Sep 25, 2026

chore(deps): update dependency vitest to v4 [security] - autoclosed #74

Closed

1 task

Conversation

rishitank commented Sep 25, 2026

What

Every alert and the version that fixes it

How the lockfile was produced

Verification (local, Node 25.9.0, same lockfile)

Risks

What Rishi must do

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Summary by CodeRabbit

Walkthrough

Changes

Architecture Summary

Uh oh!

rishitank commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rishitank commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rishitank commented Sep 25, 2026

Uh oh!

rishitank commented Sep 25, 2026

Uh oh!

rishitank commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rishitank commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rishitank commented Oct 16, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading