chore(deps): batch Dependabot bumps into a single PR - #335
Merged
Conversation
Consolidate open api/ui/docs package updates and SHA-pinned actions/checkout + docker/login-action bumps so Dependabot PRs can be closed without serial lockfile merge conflicts.
Pre-push osv-scanner fails on known transitive CVEs when the api lockfile changes; override patched versions and drop stale ignores.
Override body-parser, brace-expansion, js-yaml, and postcss; ignore react-router until a deliberate v8 upgrade; drop stale osv ignores.
Override axios, postcss, js-yaml, sharp, svgo, adm-zip, and dompurify; drop stale osv ignores now covered by pins.
Flat-pinning brace-expansion@5.0.8 collapses the 1.x copy prettier needs; ignore the brace-expansion GHSAs instead (lint tooling only).
package-override-parity requires matching pins; UI cannot flat-pin brace-expansion@5.0.8 without breaking prettier, so ignore instead.
This was referenced Jul 28, 2026
This was referenced Jul 28, 2026
There was a problem hiding this comment.
Pull request overview
Consolidates a large batch of Dependabot updates across the monorepo (api/ui/docs), including lockfile updates and CI workflow action SHA bumps, while also adjusting OSV-scanner configuration and adding transitive dependency security pins via package.json overrides.
Changes:
- Bump application and tooling dependencies in
apps/api,apps/ui, andapps/docs(plus lockfile updates where applicable). - Add/adjust transitive security pins via
overridesand simplify OSV-scanner ignore lists where pins are now in place. - Update GitHub Actions workflow pins for
actions/checkout(anddocker/login-actionin release workflows).
Reviewed changes
Copilot reviewed 30 out of 33 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| apps/ui/package.json | Updates UI dependencies/devDependencies and adds additional transitive security pins via overrides. |
| apps/ui/osv-scanner.toml | Refreshes UI OSV ignore list to reflect pinned vs deferred advisories. |
| apps/docs/package.json | Updates docs dependencies and expands transitive security pins via overrides. |
| apps/docs/osv-scanner.toml | Removes active ignores, relying on package.json overrides for transitive CVE mitigation. |
| apps/api/package.json | Updates API dependencies/devDependencies and adds new transitive security pins via overrides. |
| apps/api/osv-scanner.toml | Updates API OSV ignore list to match current mitigation strategy. |
| apps/api/bun.lock | Lockfile refresh for API dependency and override changes. |
| .github/workflows/infra-k3s-validate.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/infra-compose-validate-compose.yml | Bumps actions/checkout SHA pin in multiple jobs. |
| .github/workflows/infra-compose-security-secrets.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/infra-compose-playwright-e2e.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/infra-compose-full-stack-smoke.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/infra-bootstrap-validate.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/infra-bootstrap-security-secrets.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/infra-bootstrap-security-deps.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-ui-validate.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-ui-security-secrets.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-ui-security-sast.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-ui-security-deps.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-ui-release.yml | Bumps actions/checkout and docker/login-action SHA pins. |
| .github/workflows/apps-ui-bundle-diff.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-docs-security-secrets.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-docs-security-deps.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-docs-linkcheck.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-api-security-secrets.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-api-security-sast.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-api-security-deps.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-api-release.yml | Bumps actions/checkout and docker/login-action SHA pins. |
| .github/workflows/apps-api-openapi-drift.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-api-ci.yml | Bumps actions/checkout SHA pin. |
| .github/workflows/apps-api-acl-drift.yml | Bumps actions/checkout SHA pin. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
CI failed because bun audit does not read osv-scanner.toml. Add a small wrapper that applies those GHSA ignores, align docs sharp override with the direct 0.35.3 pin, and refresh the ioredis rationale.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkout(v7.0.1) /docker/login-action(v4.5.1).astro→ 7.1.1, superseding chore(deps): bump astro from 7.0.6 to 7.1.0 in /apps/docs in the npm_and_yarn group across 1 directory #325's 7.1.0).Supersedes
#307 #308 #309 #311 #313 #315 #317 #319 #320 #321 #322 #323 #324 #325 #326 #327 #328 #329 #330 #331 #332 #333 #334
Test plan