build(deps): bump the npm_and_yarn group across 2 directories with 19 updates#3
Open
dependabot[bot] wants to merge 1 commit into
Open
build(deps): bump the npm_and_yarn group across 2 directories with 19 updates#3dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
… updates Bumps the npm_and_yarn group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [file-type](https://github.com/sindresorhus/file-type) | `21.3.1` | `21.3.2` | | [hono](https://github.com/honojs/hono) | `4.12.7` | `4.12.18` | | [undici](https://github.com/nodejs/undici) | `7.22.0` | `7.24.0` | | [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.3` | `8.0.5` | | [axios](https://github.com/axios/axios) | `1.13.5` | `1.16.1` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.2.0` | `5.3.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.4` | `5.0.6` | | [defu](https://github.com/unjs/defu) | `6.1.4` | `6.1.7` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.2` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.1.0` | `10.2.0` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.3.0` | `8.4.2` | | [uuid](https://github.com/uuidjs/uuid) | `8.3.2` | `13.0.2` | Bumps the npm_and_yarn group with 2 updates in the /ui directory: [dompurify](https://github.com/cure53/DOMPurify) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `file-type` from 21.3.1 to 21.3.2 - [Release notes](https://github.com/sindresorhus/file-type/releases) - [Commits](sindresorhus/file-type@v21.3.1...v21.3.2) Updates `hono` from 4.12.7 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.7...v4.12.18) Updates `undici` from 7.22.0 to 7.24.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.22.0...v7.24.0) Updates `yaml` from 2.8.2 to 2.8.3 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.2...v2.8.3) Updates `dompurify` from 3.3.3 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.0) Updates `vite` from 8.0.3 to 8.0.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite) Updates `@opentelemetry/exporter-prometheus` from 0.214.0 to 0.218.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.214.0...experimental/v0.218.0) Updates `axios` from 1.13.5 to 1.16.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.5...v1.16.1) Updates `basic-ftp` from 5.2.0 to 5.3.1 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.2.0...v5.3.1) Updates `brace-expansion` from 5.0.4 to 5.0.6 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.4...v5.0.6) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `fast-uri` from 3.1.0 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) Updates `follow-redirects` from 1.15.11 to 1.16.0 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) Updates `ip-address` from 10.1.0 to 10.2.0 - [Commits](https://github.com/beaugunderson/ip-address/commits) Updates `path-to-regexp` from 8.3.0 to 8.4.2 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md) - [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.2) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `postcss` from 8.5.6 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.14) Updates `protobufjs` from 6.8.8 to 7.5.4 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@6.8.8...protobufjs-v7.5.4) Updates `uuid` from 8.3.2 to 13.0.2 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/v13.0.2/CHANGELOG.md) - [Commits](uuidjs/uuid@v8.3.2...v13.0.2) Updates `dompurify` from 3.3.3 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.0) Updates `vite` from 8.0.3 to 8.0.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite) --- updated-dependencies: - dependency-name: file-type dependency-version: 21.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.24.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: yaml dependency-version: 2.8.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@opentelemetry/exporter-prometheus" dependency-version: 0.218.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.16.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 8.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-version: 7.5.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 13.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.5 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Request Changes
This PR aims to update 19 npm dependencies, but a critical security regression was introduced by downgrading undici from 7.24.6 to 7.24.0 in extensions/zalo/package.json, re-exposing the project to multiple high-severity CVEs.
| Priority | File | Category | Impact Summary | Anchors |
|---|---|---|---|---|
| P1 | extensions/zalo/package.json |
Security | Downgrade reintroduces high-severity CVEs | |
| P2 | package.json |
Security | Major uuid version jump may have breaking changes | |
| P2 | diagnostics-otel/package.json |
Maintainability | 0.x OTel bump may include breaking API changes |
🔍 Notable Themes
- No cross-cutting patterns identified.
📈 Risk Diagram
This diagram illustrates the security risk introduced by downgrading undici to a version with known high-severity vulnerabilities.
sequenceDiagram
participant Dev as Developer
participant PR as PR #35;3
participant Dep as undici@7.24.0
participant Vuln as Vulnerabilities
Dev->>PR: Bump undici to 7.24.0
PR->>Dep: Downgrades to 7.24.0
note over Dep: Reintroduces CVE-2026-1528,<br/>CVE-2026-2229, CVE-2026-1526
Dep->>Vuln: Exposed to malicious WebSocket frames
note over Vuln: R1(P1): Unbounded memory consumption<br/>or crash via permessage-deflate
⚠️ **Unanchored Suggestions (Manual Review Recommended)**
The following suggestions could not be precisely anchored to a specific line in the diff. This can happen if the code is outside the changed lines, has been significantly refactored, or if the suggestion is a general observation. Please review them carefully in the context of the full file.
📁 File: extensions/zalo/package.json
This change downgrades undici from 7.24.6 to 7.24.0. According to the release notes provided in the PR description, version 7.24.0 includes fixes for multiple high‑severity CVEs (e.g., CVE‑2026‑1528, CVE‑2026‑2229, CVE‑2026‑1526), and versions after 7.24.0 contain additional security patches. Downgrading to 7.24.0 reintroduces these vulnerabilities (e.g., unbounded memory consumption in WebSocket decompression, unhandled exceptions from invalid server_max_window_bits). This is a direct security regression. The change is not a bump but a downgrade, contradicting the PR’s stated purpose.
Suggestion:
"undici": "7.24.6"Related Code:
"dependencies": {
- "undici": "7.24.6"
+ "undici": "7.24.0"
},📁 File: package.json
Speculative: The PR description lists a major version bump for uuid from 8.3.2 to 13.0.2. No changed file in pr_details directly reflects this bump (it is likely a transitive dependency or only present in pnpm-lock.yaml). A jump from v8 to v13 indicates breaking changes (e.g., removed UUID methods, altered exports). Without evidence of how uuid is consumed in the codebase, the severity cannot be confirmed. This is a high‑visibility risk that warrants manual verification.
Related Code:
📁 File: diagnostics-otel/package.json
Speculative: The @opentelemetry/sdk-node dependency is bumped from ^0.214.0 to ^0.218.0. Because this is a 0.x semver range, even a minor bump may include breaking API changes. The related‑context search found no usage of this package in the project code, so the practical impact is unknown. However, any OTel init code (e.g., in the extension’s index) could silently break at runtime. The bump should be verified against the extension’s OTel configuration and the upstream changelog.
Related Code:
"@opentelemetry/sdk-node": "^0.214.0",
+ "@opentelemetry/sdk-node": "^0.218.0",💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 15 updates in the / directory:
21.3.121.3.24.12.74.12.187.22.07.24.02.8.22.8.33.3.33.4.08.0.38.0.51.13.51.16.15.2.05.3.15.0.45.0.66.1.46.1.73.1.03.1.21.15.111.16.010.1.010.2.08.3.08.4.28.3.213.0.2Bumps the npm_and_yarn group with 2 updates in the /ui directory: dompurify and vite.
Updates
file-typefrom 21.3.1 to 21.3.2Release notes
Sourced from file-type's releases.
Commits
e18028c21.3.2a155cd7Fix ZIP bomb in known-size ZIP probing6954817Harden parser more370ed91Fix bound recursive BOM and ID3 detectiond2ecea1Add a few more safeguards41fcff5Update readmea8f6934Fix CIUpdates
honofrom 4.12.7 to 4.12.18Release notes
Sourced from hono's releases.
... (truncated)
Commits
f10dee84.12.18a5bd9ebMerge commit from fork58d3d3aMerge commit from fork568c2ecMerge commit from forkff2b3d34.12.1752aaaf9fix(types): propagate middleware response types to app.on overloads (#4906)76d5589fix(cors): make origin optional in CORSOptions (#4905)8f027e5fix(ssg): addatom+xmlandrss+xmltodefaultExtensionMap(#4899)bfba97cfix(jsx): normalize SVG attributes on the <svg> root element (#4893)90d41824.12.16Updates
undicifrom 7.22.0 to 7.24.0Release notes
Sourced from undici's releases.
... (truncated)
Commits
07a3906Bumped v7.24.0 (#4887)74495c6fix: reject duplicate content-length and host headers84235c6Fix websocket 64-bit length overflow77594f9fix: validate upgrade header to prevent CRLF injectioncb79c57fix: validate server_max_window_bits range in permessage-deflate4147ce2Merge commit '2ee00cb3'2ee00cbfix(websocket): add maxDecompressedMessageSize limit for permessage-deflate5890c7bfix(deduplicate): stream response chunks to waiting handlersfbda3c1Bumped v7.23.0 (#4884)07276c9fix: remove unused kSocketPath symbolUpdates
yamlfrom 2.8.2 to 2.8.3Release notes
Sourced from yaml's releases.
Commits
ce145872.8.31e84ebbfix: Catch stack overflow during node composition6b24090ci: Include Prettier check in lint action9424deechore: Refresh lockfiled1aca82Add trailingComma ToString option for multiline flow formatting (#670)4321509ci: Drop the branch filter from GitHub PR actions47207d0chore: Update docs-slate5212faechore: Update docs-slateUpdates
dompurifyfrom 3.3.3 to 3.4.0Release notes
Sourced from dompurify's releases.
Commits
5b16e0bGetting 3.x branch ready for 3.4.0 release (#1250)Updates
vitefrom 8.0.3 to 8.0.5Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
1a12d4crelease: v8.0.579f002ffix: avoid path traversal with optimize deps sourcemap handler (#22161)a9a3df2fix: checkserver.fsafter stripping query as well (#22160)f02d9fdfix: apply server.fs check to env transport (#22159)f05f501fix: disallow referencing files outside the package from sourcemap (#22158)7339bdcrelease: v8.0.454229e7docs: addenvironment.fetchModuledocumentation (#22035)b0da973feat: allow esbuild 0.28 as peer deps (#22155)22b0166fix(deps): update all non-major dependencies (#22143)17330d2fix: add types forvite/modulepreload-polyfill(#22126)Updates
@opentelemetry/exporter-prometheusfrom 0.214.0 to 0.218.0Release notes
Sourced from @opentelemetry/exporter-prometheus's releases.
... (truncated)
Commits
06ad0eachore: prepare next release (#6703)38ca257feat(otlp-transformer): replace protobufjs metrics serialization with custom ...013c600chore: prepare next release (#6699)b7a0c63feat(semantic-conventions): update semantic conventions to v1.41.1 (#6695)774143bchore(renovate): add minimumReleaseAge to config (#6697)e0dafe0fix(otlp-exporter-base): remove brackets from IPv6 hostname in HTTP transport...f804c93chore(deps): update github/codeql-action digest to 68bde55 (#6682)95e48e7refactor(sdk-logs): aliasLoggerProviderConfigtoLoggerProviderOptions(...907b627feat(sdk-node): allow startNodeSDK() without an arg (#6688)0d15261docs: Add SIG meeting info and welcoming language (#6689)Updates
axiosfrom 1.13.5 to 1.16.1Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
1337d6bchore(release): prepare release 1.16.1 (#10877)858a790fix: remove all caches (#10882)34adfd9revert: "fix: support URL object as config.url input (#10866)" (#10874)847d89bfix: support URL object as config.url input (#10866)4094886fix(progress): guard malformed XHR upload events (#10868)44f0c5bchore: change sponsorship link and add Twicsy advertisement (#10869)64e1095chore: update PR and issue template to use h2 (#10865)3e6b4e1fix: error unexpected token in fetch JS compatibility issue with Webpack 4 (#...c4453bafix: add the ability to add additional sponsors to the process sponsors scrip...caa00a9fix: https data in cleartext to proxy (#10858)Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
basic-ftpfrom 5.2.0 to 5.3.1Release notes
Sourced from basic-ftp's releases.
Changelog
Sourced from basic-ftp's changelog.
Commits
980371bGuard against unbounded control response50827c7Adjust changelog to match release notesc9378a8Fix test22abe43Update Github Actions0feaaecFix test6629d7dImprove error message9c3bf4fSet higher default value for max size of directory listingacd3942Bump version1304429Offer maxListingBytes as an option5cb5367Add bounded StringWriterMaintainer changes
This version was pushed to npm by patrickjuchli, a new releaser for basic-ftp since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
brace-expansionfrom 5.0.4 to 5.0.6Commits
46317b55.0.6c0b095bMerge commit from forkec56020Bump picomatch from 4.0.3 to 4.0.4 (#93)87939015.0.59a02af5Merge commit from forkdaa71bcBump tar from 7.5.10 to 7.5.11 (