Repository navigation
⬆️ chore: Refresh Dependencies Within Their Majors and Clear the Fixable Audit Findings - #189
Merged
Merged
Conversation
…ble Audit Findings Moves every direct dependency to the newest release inside its current major, and the override pins with them: vite 8.3.5, vitest 4.1.12 (every @vitest/* package follows), zod 4.6.7, eslint 10.13.0, react/react-dom 19.3.1 with @types/react and @types/react-dom 19.3.0, tailwindcss, @tailwindcss/vite and @tailwindcss/node 4.3.3, @radix-ui/react-dialog 1.3.1 (its dismissable-layer dedupe pin moves to 1.2.1, so one copy remains), @tanstack/react-devtools 0.10.13 (devtools 0.15.0, devtools-ui 0.7.1), input-otp 1.5.0, styled-components 6.6.0, lodash and lodash-es 4.18.1, mongoose 8.24.7, prettier 3.9.10, @typescript-eslint/* 8.72.0, eslint-plugin-import-x 4.17.1, eslint-plugin-tailwind-canonical-classes 1.6.0, @playwright/test 1.64.1, @axe-core/playwright 4.14.0, the @testing-library patches, @types/node 22.20.5 and @types/bun 1.4.4. 0.x packages stay inside their minor, except prettier-plugin-tailwindcss 0.7.4 -> 0.8.1, whose one breaking change is requiring Prettier 3.7 or newer. The override pins for postcss (vite 8.3 needs ^8.5.30), browserslist, baseline-browser-mapping, katex, nanoid, ws and yaml move to their newest patch. The undici pin is dropped: nothing in the tree depends on undici. TanStack router and start stay at 1.169.4's set, with seroval, srvx and solid-js. bun audit goes from 33 findings (1 critical, 17 high, 14 moderate, 1 low) to 1. launch-editor 2.14.2, shell-quote 1.12.0, follow-redirects 1.16.1, tmp 0.2.7, brace-expansion (1.1.21 and 5.0.12) and @humanfs/node 0.16.8 are resolved inside the ranges their parents declare, so none of them needs an override. The remaining finding is zod 3.25.76 under librechat-data-provider (GHSA-mrhx-c7xc-m3w5), which requires zod 3 and has no patched 3.x release. The tree was resolved with a one-day release-age floor, so i18next-browser-languagedetector stays at 8.2.2, baseline-browser-mapping at 2.11.32, follow-redirects at 1.16.1 and unplugin at 3.4.0. bun.lock keeps "lockfileVersion": 1, which Bun 1.2.0 and newer read; CI (latest Bun) and the Docker image (1.4.3) both install it frozen. Bun 1.4 labels a from-scratch resolve 2, which only Bun 1.4 and newer read. @librechat/data-schemas stays at 0.0.74: 0.0.75 through 0.0.77 import runtime values that librechat-data-provider 0.8.524, the newest on npm, does not export. input-otp 1.5 clears its selection re-sync timers on unmount, so AuthCard's tests drop the fake clock that kept them from firing into a torn-down jsdom; the teardown test now fails if they leak again. The canonical-classes rule rewrites has-[:disabled]: to has-disabled: (same CSS), and the Vite config uses import.meta.dirname in place of __dirname. TanStack Devtools 0.15 adds a resize handle with role="separator" to the dev server's page, so the 2FA e2e test looks for the OTP separator inside the OTP input. A separate commit applies Prettier 3.9's formatting to src, with no other changes.
Contributor
Author
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
# Conflicts: # bun.lock # package.json
This was referenced Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Template
Summary
Brings every dependency up to the newest release inside its current major and clears every
bun auditfinding that can be fixed in this repo: 33 findings drop to 1. The one left is zod 3 insidelibrechat-data-provider, which only a new data-provider release can fix (see Held back).The PR has two commits:
package.json,bun.lockand three small source changes the new versions call for.src(bun run format). It only reformats; reviewing commit 1 on its own is enough.What moved
Direct dependencies:
vite(and its override pin)vitest, every@vitest/*zodreact,react-dom@types/react/@types/react-domtailwindcss,@tailwindcss/vite,@tailwindcss/node@radix-ui/react-dialog(and override)@tanstack/react-devtools(and override)input-otpstyled-componentsdayjsi18next-browser-languagedetectorlodash(andlodash/lodash-esoverrides)mongoose(and override)eslint@typescript-eslint/eslint-plugin,@typescript-eslint/parsereslint-plugin-import-xeslint-plugin-tailwind-canonical-classesprettierprettier-plugin-tailwindcss@playwright/test@axe-core/playwright@testing-library/dom/react/jest-dom@types/node(stays on 22.x)@types/bunprettier-plugin-tailwindcssis the one 0.x package that leaves its minor. Its only breaking change is that it needs Prettier 3.7 or newer, and this PR moves Prettier to 3.9.10.Override pins:
@radix-ui/react-dismissable-layer1.1.11 → 1.2.1, so dialog and dismissable layer still resolve to one copy.@tanstack/devtools0.11.0 → 0.15.0 and@tanstack/devtools-ui0.5.1 → 0.7.1 followreact-devtools.postcss8.5.23 → 8.5.31 (Vite 8.3 requires^8.5.30),browserslist4.28.7 → 4.29.4,baseline-browser-mapping2.11.0 → 2.11.32,katex0.18.2 → 0.18.11,nanoid3.3.18 → 3.3.20,ws8.21.0 → 8.22.0 andyaml2.8.3 → 2.9.1.undici: no package in the tree depends on it.seroval,srvxandsolid-js.The tree was resolved with a one-day release-age floor (
bun install --minimum-release-age=86400), so nothing published in the previous 24 hours came in. That heldi18next-browser-languagedetectorat 8.2.2,baseline-browser-mappingat 2.11.32,follow-redirectsat 1.16.1 and the transitiveunpluginat 3.4.0. Since then,i18next-browser-languagedetector8.2.3 and@typescript-eslint/*8.72.1 have come out inside their ranges. They aren't taken here; the next refresh will pick them up.Audit, before and after
mainshell-quote(critical),launch-editor,follow-redirects,tmp,brace-expansion1.x and 5.x,@humanfs/node,vite8.0.16,vitest/@vitest/mocker4.1.9,zod4.4.3 and 3.25.76zod3.25.76 underlibrechat-data-provider(GHSA-mrhx-c7xc-m3w5)None of the fixes needs a new override.
launch-editor2.14.2,shell-quote1.12.0,follow-redirects1.16.1,tmp0.2.7,brace-expansion1.1.21 / 5.0.12 and@humanfs/node0.16.8 all fall inside the ranges their parents declare, so the lockfile resolves them without pins. That also leaves them free to take later security fixes.bun auditlists the remaining advisory aszod@4.6.7, 3.25.76, but only the 3.25.76 copy is affected. The panel's own zod and TanStack's (deduped to the same copy) are on the patched 4.6.7.Source changes in commit 1
src/components/InputOTP.tsx:has-[:disabled]:opacity-50becomeshas-disabled:opacity-50. The new canonical-classes rule flags the old form. Both compile to the same:has(:disabled)CSS on Tailwind 4.3.3.vite.config.ts:__dirnamebecomesimport.meta.dirname. Vite 8.3 warned about it three times per build, and the warning is gone.src/components/__tests__/AuthCard.test.tsx: input-otp 1.5 clears its selection re-sync timers (0, 10 and 50 ms) on unmount. The fake clock that kept those timers from firing into a torn-down jsdom is no longer needed, so it is removed along with its comment. The teardown test now guards against them directly: it fails with input-otp 1.4.2 and passes with 1.5.0.e2e/login.spec.ts: TanStack Devtools 0.15 adds a resize handle withrole="separator"to the pagevite devserves, so the 2FA test's[role="separator"]matched two elements. The test now looks for the separator inside the OTP input ([data-input-otp-container] [role="separator"]).Lockfile and Bun version
bun.lockstays at"lockfileVersion": 1("configVersion": 1), likemain. Bun 1.2.0 or newer reads it:node_modulestree as Bun 1.4.0: 988 packages, all at the same versions.Both places that install from the lockfile already read it, so
ci.ymlis unchanged:oven-sh/setup-bun@v2runs without abun-version, so it installs the latest Bun. The most recent CI run got 1.4.4.oven/bun:1.4.3-alpine.Bun 1.4 writes
"lockfileVersion": 2whenever it resolves the whole tree from scratch, and Bun 1.3 and older can't read version 2: 1.3.14 stops withUnknownLockfileVersion, while 1.4.0 and 1.4.4 read it. Updating an existing version-1 lockfile keeps it at 1. If a later refresh does a from-scratch resolve, either set the label back to 1 or declare Bun 1.4 as the minimum, through apackageManagerfield andbun-versionin CI.Held back
zod3.25.76 (GHSA-mrhx-c7xc-m3w5).librechat-data-provider0.8.524, the newest on npm, requireszod ^3.22.4, and no patched 3.x release exists. Only signed-in admins can reach it: importing YAML and saving configuration both validate admin input with data-provider's zod-3configSchema.@librechat/data-schemasstays at 0.0.74. 0.0.75, 0.0.76 and now 0.0.77 import runtime values that data-provider 0.8.524 doesn't export (31 in 0.0.77, such asAUTH_USER_DOC_CACHE_TTL_MSandchatProjectsConfigSchema), so loading their main entry throws. 0.0.77 also importszodat runtime without declaring it as a dependency.devmerged "Migrate to Zod v4" (⬆️ feat: Migrate to Zod v4 LibreChat#17442). The data-provider ondevis now 0.8.530 withzod ^4.6.7, but npm hasn't published it yet. Once it is published, bumplibrechat-data-providerand@librechat/data-schemastogether in their own PR. That clears the last audit finding, and it needs a few panel changes:_def.typeName).invalid_union'sunionErrors,invalid_enum_valueandreceived.AuditActiongrows from 4 to 39 actions in data-schemas 0.0.76 and later, so the audit-log tab'sRecord<AuditAction, …>maps need to narrow to the actions they render.dotenv18,i18next26,react-i18next17,js-yaml5,mongoose9,lucide-react1.x,@testing-library/jest-dom7,@types/node26,@vitejs/plugin-react6,jsdom30,lint-staged17,typescript7 andvitest5.@clickhouse/click-ui0.9 → 0.15.@tanstack/devtools-vitestays pinned at 0.3.12 rather than moving to 0.8, and thelaunch-editor/shell-quotefixes reach it inside its ranges.@tanstack/react-query5.105.0: the TanStack query set is pinned exactly and moves as one set, so it isn't in this PR.Change Type
Testing
All checks were run on the final branch, rebased on current
main, and each exited 0:bun install --frozen-lockfile. Thereact-movablepatch still applies, and a plainbun installleavesbun.lockuntouched.npx tsc --noEmitnpx eslint src/ e2e/ --max-warnings 0bun run format:check(Prettier 3.9.10).bun run test:lint-rules: 19 of 19 pass.npx vitest run: 154 files and 3338 tests pass, with no unhandled errors.bun run build, with no__dirnamewarning.bun auditbefore and after, as in the table above.Live click-through of the production build against a LibreChat backend:
25 (librechat.yaml) → 33.Every dialog and drawer closed with the page's pointer events restored. All 75 server-function calls answered 200 (73 GET, 2 POST), with no console or page errors. The only failed requests were two model-list fetches that the test's own reloads cancelled while they were in flight.
Earlier, on the same lockfile before the rebase:
vite dev) rendered TanStack Devtools 0.15, with the Router and Query panels, without console errors.AuthCard.test.tsxwas green on repeated runs.Playwright e2e (not run by CI), the whole suite against
e2e/mock-backend.mjs, on this branch and onmain:login.spec.ts: all 29 tests pass. Before the separator fix, one 2FA test failed here and passed onmain.main: 46 tests inaccess.spec.tsandgrants.spec.ts. They expect roles, groups and grants that the server functions now read from LibreChat's admin API, whiche2e/mock-backend.mjsdoesn't serve. 45 of them failed the same way before 🛂 fix: Decide Admin Access Before the Panel Renders and Fail Closed on Errors #185; the 46th is 🛂 fix: Decide Admin Access Before the Panel Renders and Fail Closed on Errors #185's admin gate askingGET /api/admin/grants/effective, which a separate PR adds to the mock. No test fails only on this branch.After rebasing onto
main(#188 to #202 merged): the full mock e2e suite gives 86 passed and 5 failed. Three are the Grants axe tests that also fail onmain. The other two are the Access page axe scans. They now fail because@axe-core/playwright4.14 checks Label in Name (label-content-name-mismatch, WCAG 2.5.3), and two shell controls already break it onmain:The app is unchanged by this PR. A follow-up a11y PR fixes both controls, along with the Grants axe failures.
Test Configuration:
bun run build+bun run start) withSESSION_COOKIE_SECURE=falseover plain HTTP.dev, before the Zod v4 merge.Checklist