misc: resolve all 73 open Dependabot alerts - #171
Merged
Conversation
Bumps direct dependencies and adds/updates npm overrides so every
package flagged by Dependabot resolves at or above its patched version.
Direct dependencies:
- axios 1.13.6 -> 1.19.0 (28 alerts: proxy credential leak, SSRF,
prototype pollution, ReDoS, DoS)
- body-parser 1.20.4 -> 1.20.6 (limit bypass DoS)
- js-yaml 3.14.2 -> 3.15.1 (merge-key quadratic DoS)
- typeorm 0.3.28 -> 0.3.31 (orderBy SQL injection, migration codegen
injection)
Overrides (transitive, mostly via notifme-sdk -> node-pushnotifications
-> firebase-admin/google-cloud):
- protobufjs 7.5.3 -> 7.6.5 (12 alerts, incl. code injection)
- @protobufjs/utf8 1.1.0 -> 1.1.2
- nodemailer 7.0.13 -> 9.0.3 (raw-option file read/SSRF, CRLF
header injection, OAuth2 TLS)
- websocket-driver 0.7.4 -> 0.7.5 (critical: message corruption)
- @grpc/grpc-js 1.13.4 -> 1.14.4 (malformed-request crash)
- lodash 4.17.23 -> 4.18.1
- form-data 4.0.5 -> 4.0.6 (CRLF injection)
- fast-xml-parser 5.5.9 -> 5.10.1
- fast-xml-builder 1.1.4 -> 1.3.0 (attribute-quote bypass)
- follow-redirects 1.15.11 -> 1.16.0
- qs 6.15.0 -> 6.15.3 (stringify DoS)
- uuid 8.3.2/9.0.1 -> 11.1.1 (missing buffer bounds check)
- path-to-regexp@0.1 -> 0.1.13 (ReDoS via express 4)
- @tootallnate/once -> 2.0.1
- brace-expansion@1 -> 1.1.18, @2 -> 2.1.4 (unbounded expansion OOM)
- js-yaml@4 -> 4.3.1 (mocha, dev-only)
The node-gcm-scoped axios override is replaced by a top-level one so a
single deduped copy is installed instead of two.
Verified: npm audit reports 0 vulnerabilities, tsc build succeeds, test
suite passes, and notifme-sdk still constructs SMTP and SES transports
against nodemailer 9.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vivek-devtron
approved these changes
Aug 3, 2026
prkhrkat
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 73 open Dependabot alerts across 19 packages (2 critical, 21 high, remainder medium/low) by bumping direct dependencies and adding/updating npm
overrides.Direct dependency bumps
orderBySQL injection, migration codegen injectionOverride bumps (transitive)
Nearly all remaining alerts come from a single chain:
notifme-sdk → node-pushnotifications → firebase-admin / @google-cloud/*. The intermediate packages pin old ranges, so these are fixed viaoverrides.stringifyDoSThe
node-gcm-scoped axios override is replaced by a top-level one, so a single deduped copy is installed instead of two independently-pinned ones that would drift and re-alert.Verification
npm audit→ 0 vulnerabilitiespackage-lock.jsonagainst the exactfirst_patched_versionfrom its alert — all at or above itnpm run build-tscompiles cleangetCommitsFromGitTriggers.test.tsandnotificationService.test.ts; the other 5 files insrc/tests/were already empty suites before this change)notifme-sdkverified to still construct both SMTP and SES transports against nodemailer 9Reviewer attention
nodemailer 7 → 9 is a forced major bump.
notifme-sdkdeclaresnodemailer: 6.9.10; the override pushes it to 9.0.3. This extends the pre-existing v7 override rather than introducing one. The two APIs notifme-sdk actually uses —nodemailer.createTransport()(SMTP) andnodemailer/lib/mail-composer(SES) — were smoke-tested and construct correctly, but no real mail was sent. A live SMTP/SES send test before release is recommended.uuid 8/9 → 11 is also a forced major, applied to the Google Cloud libraries. There is no backport on the 8.x/9.x lines, so v11 is the only patched option. It dedupes to a single copy and builds clean; the affected code path (push notifications) is not one this service exercises.
🤖 Generated with Claude Code