chore(deps): bump prod dependencies, hold better-sqlite3 at 12.x - #1926
Merged
Conversation
Replaces Dependabot PR #1889, rebuilt on current beta with a full `npm install` (not --package-lock-only) so the lockfile hoists correctly. Includes 15 of the group's updates: - @fastify/static 9.1.3 -> 10.1.2 (remediates GHSA-8pvw-jcv7-9cmj and GHSA-83w8-p2f5-377r: route guard bypass via path traversal, plus two medium alerts). The only v10 breaking change is the `setHeaders` signature (Response -> FastifyReply); this app uses an `onSend` hook instead and passes only root/prefix/maxAge/immutable, so it is unaffected. - fastify 5.9.0 -> 5.10.0, @fastify/compress, @fastify/cookie, @fastify/helmet, @fastify/multipart, ical-generator, node-cron - react/react-dom 19.2.7 -> 19.2.8 (root `overrides` bumped in lockstep, otherwise the override pins the old version and the manifest bump is a no-op), @floating-ui/react, i18next, react-i18next Deliberately EXCLUDES better-sqlite3 12.11.1 -> 13.0.1. v13 removed the `prebuild-install` dependency and its install script is now a bare `node-gyp rebuild`, so it always compiles from source. The Dockerfile's `deps` stage is explicitly built around prebuilt binaries (no python3 or build-base) and runs on the target platform, so a source build would be compiled under emulation for arm64. Adopting v13 needs its own change to the image and is tracked separately.
Contributor
|
🎉 This PR is included in version 2.13.0-beta.39 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces #1889, rebuilt on current
betawith a fullnpm installso the lockfile hoists correctly (per CLAUDE.md's Dependency Policy — Dependabot's regenerated lockfile can nest workspace deps).Carries 15 of the group's 16 updates. The one exclusion is deliberate.
Security impact
Remediates 4 open Dependabot alerts by taking
@fastify/static9.1.3 → 10.1.2:Is the v10 major safe here?
Yes. The sole v10.0.0 breaking change is the
setHeaderssignature (Response→FastifyReply). This app has exactly one registration site (server/src/app.ts:323) which passes onlyroot/prefix/maxAge/immutable, and deliberately uses anonSendhook rather thansetHeaders(see the comment atapp.ts:330). Unaffected.Excluded: better-sqlite3 12.11.1 → 13.0.1
better-sqlite3 v13 removed
prebuild-install— its install script is now a barenode-gyp rebuild, so it always compiles from source:scripts.installprebuild-install || node-gyp rebuild --releasenode-gyp rebuildbindings,prebuild-installnode-addon-apionlyThe Dockerfile's
depsstage is explicitly designed around this (lines 57–73: "no compilation, no build-base/python3 needed") and runs on the target platform, so an arm64 build would compile SQLite under QEMU emulation. That was the actual cause of #1889's Docker failure — not a flake.Adopting v13 requires adding
python3/build-baseto thedepsstage and accepting a much slower cross-arch build. That deserves its own PR, so better-sqlite3 stays at 12.11.1 here (it has no open security alert).Note on react/react-dom
Dependabot bumped the manifests to 19.2.8 but the root
overridesblock still pinned 19.2.7, so the lockfile silently kept the old version. This PR bumps the overrides in lockstep so manifest and lockfile agree.Test plan
Closes #1889