chore(deps): audit fix client and root deps - #143
Merged
Conversation
Clears 5 of 15 high advisories in the root audit (17 -> 12 entries). - nodemon ^2.0.3 -> ^3.1.14 removes the semver 7.0.0 ReDoS (GHSA-c2qf-rxjj-qqgw) pulled in via simple-update-notifier. Semver-major per npm, but nodemon is dev-only and both invocations here use flags unchanged in v3; watch/restart and --inspect verified against the container (Node v24.11.1). - serve ^14.2.6 removed. It was declared in dependencies but referenced by no code, script, Dockerfile, workflow, or doc; production static files are served by express.static in app.js. Drops serve + serve-handler advisories. react-quill intentionally left in root: it is not declared in client/package.json and the client resolves it plus quill via hoisting, so removing it breaks the rich text editor. The quill XSS moderate (GHSA-4943-9vgg-gr5r) therefore stays; react-quill 2.0.0 pins quill ^1.3.7 and no fixed 1.x exists. The remaining 10 highs are all brace-expansion GHSA-mh99-v99m-4gvg (published 2026-07-24) reaching the eslint/glob chain through minimatch. No override is safe: the only fixed version, 5.0.8, is ESM-first requiring Node >=20 and its CommonJS build exports an object rather than a callable, which minimatch 3.x would crash on. Clearing those needs eslint 7 -> 10, a flat-config migration. Verified: docker rebuild, smoke-test.sh 9/9, Playwright e2e 23/23 including the Quill editor, format, theme, and persistence specs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Resolves conflict in client/package.json against dev (PR #142). Dev bumped gh-pages to ^5.0.0 and fixed the `gh-pages -d-build` typo in the deploy script; this branch had already gone to ^6.3.0. Kept ^6.3.0 and took dev's typo fix, so the deploy script is correct on the newer major. client/package-lock.json resolved to this branch's copy. Dev's only lockfile delta since 2f1cf47 was dropping gh-pages 2 transitive deps (query-string, normalize-url, filenamify-url and friends), which this branch already dropped at gh-pages 6. `npm install --package-lock-only` produced no drift, confirming the lock matches the resolved manifest. Verified: client tests pass (4/4), gh-pages@6.3.0 and no draft-js in the installed tree, and root audit advisories drop from 44 on dev to 14 here. The remaining brace-expansion <=5.0.7 advisory has no published fix and is what inflates npm's raw vulnerability count. Pre-existing and untouched by this merge: `npm run build` fails on eslint style errors across ~30 files in client/src, which this branch does not modify and whose lint toolchain versions are identical to dev.
smithynb
marked this pull request as ready for review
July 28, 2026 18:09
clementsm
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit client and root dependencies. Also uses newest version of gh-pages.
copilot pr summary
This pull request mainly updates dependencies and makes some cleanup in both the root and client
package.jsonfiles. The most important changes include removing unused packages, updating dependency versions, and adding overrides for specific packages to address potential security or compatibility issues.Dependency removals and updates:
draft-jsfromclient/package.json, likely because it is no longer used in the project.gh-pagesfrom version^5.0.0to^6.3.0inclient/package.jsonfor the latest features and bug fixes.servefrom the rootpackage.json, indicating it is no longer needed.nodemonfrom^2.0.3to^3.1.14in the rootpackage.jsonfor improved development tooling.Security and compatibility:
overridesfornth-checkandpostcssinclient/package.jsonto ensure secure and compatible versions are used.