Repository navigation
(janitor/dependencies): patch Next, Storybook and transitive vulnerabilities - #8745
kilo-code-bot[bot] wants to merge 1 commit into
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| postcss-selector-parser@6.0.10: 7.1.6 | ||
| webpack-dev-middleware@^6: 7.4.6 | ||
| toml: 4.2.0 | ||
| toml: 5.0.1 |
There was a problem hiding this comment.
[SUGGESTION]: Document this deliberate semver-major override inline
toml moves to 5.0.1 while its only consumer in this tree, effect (reached via @kilocode/plugin in services/gastown/container), sits on the 4.x line, and v5 rejects numeric values outside the safe-integer range instead of rounding them. Comparable intentional deviations in this block (pg, @sentry/cli, lightningcss) carry a rationale comment, so a short note here would stop a future lockfile refresh from reverting to 4.x or silently widening the behavior change. I found no in-repo TOML parse path, so this is documentation only.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Executive SummaryThe Next, Storybook and transitive security bumps are version-consistent across manifests and lockfile; the only finding is documenting the deliberate semver-major Assumptions: Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (7 files)
Fix these issues in Kilo Cloud Reviewed by deepseek-flash-latest · Input: 114.9K · Output: 28.5K · Cached: 2.3M Review guidance: REVIEW.md from base branch |
Changes grouped by use
One PR because all fixes share the workspace overrides and generated pnpm lockfile; splitting them would create lockfile conflicts.
next16.3.8 → 16.4.1 across web, AI gateway, secure proxy, Storybook, and web-shared, with the matching global override. Required@next/envand platform SWC packages follow 16.4.1. Existing MDX/bundle-analyzer versions remain unchanged: neither requires an exact Next peer.storybook,@storybook/addon-docs, and@storybook/nextjs10.4.6 → 10.6.2, plus core override. Internal renderer/builder packages stay aligned. Required resolver 11.19.1 → 11.21.2, its bindings/WASM dependencies, user-event 14.6.1 → 14.6.8, reuse of existing react-docgen 8.0.3/magic-string 1.4.3, and new probe-image-size/needle subtree follow the published framework dependency ranges.wsoverride 8.21.0 → 8.21.1 is required by the patched Storybook core's^8.21.1range.dompurifyoverride 3.4.16 → 3.4.17, for Monaco and PostHog in web/extension.ip-addressoverride 10.7.1 → 10.7.4, through express-rate-limit → MCP SDK, including extension/harness/OpenClaw paths.tomloverride 4.2.0 → 5.0.1, through gastown-container → @kilocode/plugin 7.2.52 → effect 4.0.0-beta.57.Complete open-alert inventory
Fetched latest
main, enumerated all 32 open alerts with paginated REST results, and repeated enumeration before creating this PR. The 29 alerts below have non-vulnerable package resolutions in this PR, including critical/low advisories removed by the same high/medium fixes. Alerts will close only after GitHub scans merged main; none was dismissed.Inspected, unresolved here
Checked paginated open PR titles/bodies/package and alert references. #7327 only targets Next 16.3.8 and old advisories, not these <=16.4.0 findings. #7083/#8393 address earlier Hono/MCP/Vite findings. No existing PR found for the patched resolutions in this PR. #8547 may need lockfile regeneration after this lands.
Compatibility and override considerations
>=24 <25, Next>=20.9, Storybook's Node 20.19+/22.12+/24 line, TOML>=20, and ip-address>=12; DOMPurify declares no engine/peer restriction.^4.1.1. No fixed 4.x release exists. CommonJS parse API remains compatible, but v5 rejects unsafe integers instead of silently rounding them and enforces signed 64-bit bounds. Tested the actual EffectPrimitive.fileParseconsumer, normal structures/dates, eight safe integer forms, six unsafe-integer rejections and error propagation. Effect cannot pass the bigint option; configs using >53-bit numeric values will now fail and should represent those values as strings. This behavior change requires explicit reviewer attention; it is not described as a semver-compatible patch.minimumReleaseAge: 6842/exclusions unchanged. Published fixed versions: ip-address Oct 11, TOML/Storybook/DOMPurify Oct 12, Next Oct 14; all clear the 4d18h2m policy on Oct 23. pnpm enforced the policy for transitives too.Validation
Commands from
/workspace/app, each bounded to at most 210 seconds; no PostgreSQL or Redis started:node --version/pnpm --versiongh api --paginate 'repos/Kilo-Org/cloud/dependabot/alerts?state=open&per_page=100'gh api --paginate 'repos/Kilo-Org/cloud/pulls?state=open&per_page=100'NODE_OPTIONS=--max-old-space-size=4096 pnpm install --lockfile-onlyNODE_OPTIONS=--max-old-space-size=4096 pnpm install --frozen-lockfilenode /tmp/kilo/audit-security.cjspnpm --filter web typecheckpnpm --filter ai-gateway typecheckpnpm --filter ai-gateway-secure-proxy typecheckpnpm --filter @kilocode/web-shared typecheckGOMEMLIMIT=2GiB pnpm --filter @kilocode/storybook typecheckpnpm --filter ai-gateway-secure-proxy testpnpm run test:web-rewritespnpm --filter @kilocode/storybook build-storybookpnpm --filter gastown-container testpnpm --filter gastown-container typecheckpnpm --filter gastown-container lintpnpm --filter kilo-extension testnode /tmp/kilo/dependency-smoke.mjspnpm peers checkpnpm exec oxlint --config .oxlintrc.json apps/web/src apps/ai-gateway/src apps/ai-gateway-secure-proxy/src packages/web-shared/srcpnpm exec oxlint --config .oxlintrc.json apps/ai-gateway-secure-proxy/srcpnpm format apps/web/package.json apps/ai-gateway/package.json apps/ai-gateway-secure-proxy/package.json apps/storybook/package.json packages/web-shared/package.json pnpm-workspace.yaml pnpm-lock.yamlpnpm exec oxfmt --list-different apps/web/package.json apps/ai-gateway/package.json apps/ai-gateway-secure-proxy/package.json apps/storybook/package.json packages/web-shared/package.json pnpm-workspace.yamlgit diff --checkgit fetch origin main && git rev-list --left-right --count HEAD...origin/mainPrepare/tRPC emitted nonfatal Rollup unresolved-external/unused-import warnings. Not verified: PostgreSQL/Redis-dependent integration/E2E suites (resource constraint), full production Next builds, browser/native E2E, remote Storybook preview/Chromatic integrations, live MCP services, and deployed Gastown/Bun configuration loading. Full-repository lint/test/build was not run; the broader focused lint timed out as above. These are focused compatibility checks, not full-system validation.
Ready for review. Auto-merge is intentionally not enabled: the out-of-range TOML major and untested remote Storybook behavior need reviewer assessment rather than unattended merging.