fix(ci): close every open Dependabot alert - #77
Merged
Conversation
Seven alerts, six of them high. All are build- or test-time packages -- none reaches the browser bundle, and the bundle is byte-for-byte the same size afterwards -- but a compromised build chain is the supply side of the same threat, so they are closed rather than triaged away. browserslist 4.28.5/4.28.6 -> 4.28.9 (@babel/helper-compilation-targets wants ^4.24.0) fast-uri 3.1.5 -> 3.1.7 (ajv@8.20.0 wants ^3.0.1; the existing pin was one patch short) esbuild 0.27.7 -> 0.28.2 (see below) esbuild is the one that had been left open on purpose since 2026-08-18, and the reasoning in SECURITY.md was sound at the time: the fix is 0.28.1, tsup@8.5.1 declares ^0.27.0, and an override would step outside a declared range. tsup is still 8.5.1 and still declares ^0.27.0, so what changed is the measurement, not the upstream. vite -- the toolchain that builds the shipped bundle -- declares esbuild as an optional peer at `^0.27.0 || ^0.28.0` and carries ^0.28.1 in its own devDependencies. That leaves tsup as the sole objector, and tsup's job here is `build:libs` for the three workspace packages. Verified rather than assumed, because a 0.x minor is breaking by convention: build:libs on 0.28.2 emits byte-identical output (jmap ESM 89.10 KB, DTS 216.45 KB, map 337.49 KB -- the same three numbers as on 0.27.7), and the full gate passes including the dist contract and the size budget. Nothing was dismissed. Also hardens the B61 rail test, which failed once in the gate that ran these updates and was green on four isolated re-runs -- the shape of a race, and worth the measurement rather than a re-run. It took its baseline as soon as the first Inbox row was visible. This suite signs in with two delegated accounts, so there are THREE Inbox rows (alice at y=93, the shared ones at y=389 and y=481) whose sections arrive one sync pass apart, each moving the rows above it. The failing baseline was 224 -- not where any of the three ends up, i.e. a value from the middle of the settling. It now waits for the row to hold still before measuring. The assertion still has teeth: moved above the folder list, the card takes the Inbox row from y=93 to y=215 and the test goes red.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Seven alerts, six high. All build- or test-time packages — none reaches the browser bundle, and the bundle is byte-for-byte the same size afterwards. A compromised build chain is the supply side of the same threat, so they are closed rather than triaged away.
browserslist^4.24.0— insidefast-uri^3.0.1— inside (the existing pin was one patch short)esbuild^0.27.0— outside, see belowThe one that was open on purpose
SECURITY.mdrecorded esbuildGHSA-g7r4-m6w7-qqqras a deliberate exception, and the reasoning was sound: the fix is 0.28.1 andtsup@8.5.1declares^0.27.0. tsup is still 8.5.1 and still declares^0.27.0— what changed is the measurement, not the upstream.vite, the toolchain that builds the shipped bundle, declares esbuild as an optional peer at^0.27.0 || ^0.28.0and carries^0.28.1in its own devDependencies. That leaves tsup as the sole objector, and tsup's job here isbuild:libsfor the three workspace packages. Verified rather than assumed, because a 0.x minor is breaking by convention:build:libson 0.28.2 emits byte-identical output (jmap ESM 89.10 KB, DTS 216.45 KB, map 337.49 KB — the same three numbers as on 0.27.7) and the full gate passes, dist contract and size budget included.Nothing was dismissed.
SECURITY.md§5 now states there are no open alerts, and the override carries a note to drop it the moment tsup declares^0.28.A flake, measured instead of re-run
The gate that ran these updates failed once on the B61 rail test, and four isolated re-runs were green. Rather than call it and move on: it took its baseline the moment the first Inbox row was visible, and this suite signs in with two delegated accounts — so there are three Inbox rows (alice at y=93, the shared ones at y=389 and y=481) whose sections arrive one sync pass apart, each moving the rows above it. The failing baseline was 224, which is not where any of the three ends up. It was a value from the middle of the settling. It now waits for the row to hold still.
The assertion still has teeth — moved above the folder list, the card takes the Inbox row from y=93 to y=215 and the test goes red.
pnpm gategreen: 5 952 unit, 20 integration, 255 e2e, 293.64 kB gz.