Skip to content

fix(deps): security package updates - #5

Open
Nisarg48 wants to merge 4 commits into
mainfrom
fix-package-vulnerabilities
Open

fix(deps): security package updates#5
Nisarg48 wants to merge 4 commits into
mainfrom
fix-package-vulnerabilities

Conversation

@Nisarg48

@Nisarg48 Nisarg48 commented Jun 3, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Upgrade Nx from 20.7.2 → 23.1.1 (with migrations); set packageManager to npm
  • Bump vulnerable tooling parents: vite, vitest, postcss, @babel/core, @swc/cli, verdaccio, @playwright/test
  • Align lib @nx/vite / vite pins to match the workspace (no nested Nx 20)
  • Refresh lockfile so transitive minimatch and ws resolve to patched versions within parent ranges
  • No overrides / npm audit fix --force

Notes

  • Original Vanta package list is addressed via parent upgrades (including brace-expansion 2.x → ≥2.1.3)
  • npm audit may still report Nx’s nested brace-expansion 5.0.8; that is separate from the Vanta 2.x CVE and needs an upstream Nx release (or a temporary override)

This comment was marked as outdated.

This comment was marked as outdated.

Bump tooling parents and migrate the workspace from Nx 20 to 23 without
overrides so CI stays green and Vanta findings from outdated packages are cleared.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 21 out of 24 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

nx.json:113

  • This enables Nx analytics/telemetry at the workspace level ("analytics": true). That can unintentionally send usage data from CI and developer machines and is unrelated to the dependency security bump described in the PR.
  "analytics": true,

nx.json:6

  • Nx is configured to use npm (cli.packageManager: "npm"), but the repo still contains a yarn.lock alongside package-lock.json. Keeping multiple lockfiles tends to cause dependency drift and confusion about which package manager is supported.
  "cli": {
    "packageManager": "npm"
  },

Comment thread tsconfig.base.json
"strictFunctionTypes": true,
"strictPropertyInitialization": true,
"alwaysStrict": true,
"ignoreDeprecations": "6.0",

@KrishKashiwala KrishKashiwala left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread nx.json
Comment on lines +4 to +6
"cli": {
"packageManager": "npm"
},

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably needs to be removed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants