Skip to content

fix(deps): patch vulnerable build dependency chains - #469

Merged
uni-kakurenbo merged 1 commit into
masterfrom
fix/security-build-dependencies
Oct 20, 2026
Merged

uni-kakurenbo merged 1 commit into
masterfrom
fix/security-build-dependencies

Conversation

@uni-kakurenbo

@uni-kakurenbo uni-kakurenbo commented Oct 20, 2026 •

Copy link
Copy Markdown
Member

Depends on #468. This layer fixes the remaining open Dependabot glob alert (32): update the build-time glob copies from 10.4.5 to 10.5.0 and from 11.0.1 to 11.1.0 within their existing dependency ranges, addressing GHSA-5j98-mcp5-4vw2.

Upgrade ts-morph from 26.0.0 to 27.0.2 to remove the fast-glob/micromatch/braces dependency chain flagged by GHSA-vfj7-8cjw-p6xm. This uses ts-morph's TypeScript 5.9 generation and does not require a TypeScript 6 migration.

Summary by CodeRabbit

  • Chores
    • 開発環境で使用する依存関係を更新しました。

@coderabbitai

coderabbitai Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1
  • package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: a70c88a6-305b-4ee3-b1cd-1bbb2c83c914

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b47ce5a5-d0be-44f7-ab89-900c768f59bb
📥 Commits

Reviewing files that changed from the base of the PR and between d820f2f and fe25742.

⛔ Files ignored due to path filters: 1
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing: 1
  • package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

開発依存関係 ts-morph のバージョンを 26.0.0 から 27.0.2 に更新しました。

Changes: 開発依存関係の更新

Layer / File(s) Summary
ts-morph のバージョン更新
package.json
開発依存関係 ts-morph のバージョンを 26.0.0 から 27.0.2 に更新しました。

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: kaitoyama

Merge Risk: ⚪ Minimal · up to fe257

This development-dependency update introduces no identified runtime or compatibility risk and is mergeable.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed タイトルは、脆弱なビルド依存関係の修正という変更内容を正確に要約しています。ts-morphの更新とglob関連依存関係の修正に適合します。
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown
Contributor

[INFO] dist diff

Download the full diff

@uni-kakurenbo
uni-kakurenbo added this pull request to stack #470 October 20, 2026 07:35
@uni-kakurenbo
uni-kakurenbo force-pushed the fix/security-build-dependencies branch from ae2e544 to fe25742 Compare October 20, 2026 13:20
@github-actions

Copy link
Copy Markdown
Contributor

[INFO] dist diff

Download the full diff

@github-actions

Copy link
Copy Markdown
Contributor

[INFO] dist diff

Download the full diff

Base automatically changed from fix/security-generator-dependencies to master October 20, 2026 13:35
@uni-kakurenbo
uni-kakurenbo merged commit e3ab62c into master Oct 20, 2026
6 checks passed
@uni-kakurenbo
uni-kakurenbo deleted the fix/security-build-dependencies branch October 20, 2026 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant