[frontegg-david]

Stack 10/10: main ← #92 ← #93 ← #94 ← #95 ← #96 ← #98 ← #99 ← #100 ← #101 ← this

Dependabot, part 2 of 2. Together with the Nx update below this PR, it resolves all 53 open Dependabot alerts. Each alert's vulnerable range was checked with semver against every version left in yarn.lock: 0 remain.

Change

1. yarn up -R moves each vulnerable transitive package to the newest version its parents' ranges allow.
2. Raised floors in resolutions. Earlier alert fixes left floors for qs, immutable, shell-quote, svgo, fast-uri and webpack-dev-server; they now sit at the patched versions, so a future re-resolve can't drop below them.
3. Scoped resolutions where a parent pins a vulnerable version exactly, or allows no patched one:
   • nx/brace-expansion: ^5.0.9: nx 22.7.12 pins 5.0.8; now 5.0.12 (patch level).
   • sockjs/uuid: ^11.1.1: sockjs 0.3.24 (under webpack-dev-server, dev only) allows only ^8.3.2, and uuid has no patched 8.x. sockjs only calls require('uuid').v4(), which uuid 11 still exports; I checked it creates a server and generates ids. (The advisory concerns the buf argument of v3/v5/v6, which sockjs doesn't use.)
   • serve/ajv: ^8.18.0 and nx/smol-toml: ^1.7.1: see "Also fixed".

Package	Before	After	Alerts
undici	6.27.0	6.29.0	#185, #184, #153, #152, #151
js-yaml	3.14.2, 4.2.0	3.15.2, 4.3.2	#183, #182, #162, #161, #140, #139, #123
baseline-browser-mapping	2.9.19	2.11.27	#180
svgo	3.3.3	3.3.5	#179, #178, #129
qs	6.15.2	6.16.0	#177, #171
browserslist	4.28.1	4.29.3	#176
fast-uri	3.1.2	3.1.8	#174, #173, #169, #154, #131, #130
@humanfs/node	0.16.7	0.16.8	#172
postcss-selector-parser	6.1.2, 7.1.1	7.1.6	#170, #168
postcss	8.5.15	8.5.28	#159, #148
brace-expansion	1.1.15, 2.1.1, 5.0.6 (+ 5.0.8 pinned by Nx 22.7.12, #101)	1.1.21, 2.1.7, 5.0.12	#155, #150, #147, #142, #126
tar	7.5.16	7.5.22	#143, #136, #135 (critical), #134, #133
body-parser	1.20.4	1.20.8	#141
webpack-dev-server	5.2.5	5.2.6	#138, #137
shell-quote	1.8.4	1.12.0	#132
immutable	5.1.5	5.1.9	#128, #127
websocket-driver	0.7.4	0.7.5	#125, #124 (critical)
http-proxy-middleware	2.0.9	2.0.10	#122
@babel/core	7.28.6, 7.29.0	7.29.7	#119
uuid	8.3.2	11.1.1	#101

"Before" is main's lockfile, with Nx 22.4.4.

Also fixed (reported by yarn npm audit, not yet raised by Dependabot)

• axios 1.18.0 → 1.20.0 (several high: ReDoS, prototype-pollution gadgets, HTTP/2 DoS, proxy and redirect bypasses)
• ajv 8.12.0 → 8.20.0 (serve/ajv; serve pins it exactly) and 6.12.6 → 6.15.0 (ReDoS with $data)
• smol-toml 1.6.1 → 1.9.0 (nx/smol-toml; nx pins it exactly; DoS on malformed TOML)

Still reported: braces 3.0.3 (high; no patched release exists yet), plus deprecation notices that aren't vulnerabilities (eslint 9.39.2, glob 10.5.0, memfs 3.6.0, whatwg-encoding).

Verification (after nx reset)

• yarn lint, yarn format:check, yarn build (13 projects): pass
• nx run-many -t test (10 projects), core jest (67 suites, 2376 passed), core perf (48 passed), browser e2e (90 passed; it runs on serve, so it covers the ajv change): pass

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated dependency version constraints and resolutions.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: agentfront/enclave/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 78fd72ca-3468-4d0e-8458-b233bd86e536

📥 Commits

Reviewing files that changed from the base of the PR and between ff3e3a3 and bc1c4e7.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Walkthrough

Walkthrough

The package.json resolutions block updates six pinned minimum versions and adds four dependency resolutions.

Changes

Dependency resolutions

Layer / File(s)	Summary
Update dependency resolutions package.json	The resolutions block updates minimum versions for qs, immutable, shell-quote, svgo, fast-uri, and webpack-dev-server. It adds resolutions for nx/brace-expansion, nx/smol-toml, serve/ajv, and sockjs/uuid.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to bc1c4

No actionable compatibility issue introduced by this dependency update was established; the inspected SockJS API remains compatible. The PR is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating vulnerable transitive dependencies.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}