deps: update dependencies to latest - #340
Merged
Merged
Conversation
- lucide-react: 1.26.0 -> 1.27.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- @modelcontextprotocol/sdk: 1.29.0 -> 1.30.0 - @types/node: 26.1.1 -> 26.1.2 - jsdom: 29.1.1 -> 30.0.0 - @hono/node-server: 1.19.14 -> 2.0.12 (override, fixes GHSA-9mqv-5hh9-4cgg) The MCP SDK 1.30.0 bump moves @hono/node-server from 1.19.x to 2.0.8, which is in the unauthenticated WebSocket memory-leak DoS range (>=2.0.0 <=2.0.9). That lands in the published CLI's production dependency path, so there's now an override pinning it to ^2.0.12. The SDK declares ^1.19.9 || ^2.0.5, so 2.0.12 is inside its supported range. jsdom 30 rewrote getComputedStyle to compute values, and its math-function branch destructures the result of a regex that doesn't match when a calc(), min(), max() or clamp() can't be reduced to a plain length. Any percentage mixed with a length hits it, so getComputedStyle throws "object null is not iterable" for valid CSS. @testing-library/dom calls getComputedStyle on every element during a role query, so one declaration takes out every query in a file. The chart marker components position with calc(6% + 1.25rem), which is correct CSS and shouldn't change to work around a test dependency. patches/jsdom@30.0.0.patch restores the fallback jsdom already applies to bare percentages and used to apply here through 29: return the value unreduced instead of crashing. It's six lines and only affects the path that used to throw. Upstream issue: jsdom/jsdom#4193. The patch is pinned to 30.0.0, so the next jsdom bump forces a re-check. packages/web/tests/jsdom-computed-style.test.ts guards the patch so dropping it fails with a clear cause instead of a cascade of "unable to find role" errors. One moderate advisory stays open: @opentelemetry/core 2.0.0 via @microsoft/vally-cli's Azure monitor exporter. It predates this change, it's dev-only eval tooling, and OpenTelemetry pins core exactly within its SDK packages, so an override there risks breaking the exporter for a finding that isn't reachable. It belongs upstream in vally-cli. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b365a6a-506f-4d86-a9d3-a7bdbbf9ee5b
- @biomejs/biome: 2.5.5 -> 2.5.6
- @microsoft/vally-cli: 0.11.0 -> 0.12.0
- @playwright/test: 1.62.0 -> 1.62.1
- @tanstack/react-virtual: 3.14.8 -> 3.14.9
- @types/react: 19.2.17 -> 19.2.18
- @types/react-dom: 19.2.3 -> 19.2.4
- @vitejs/plugin-react: 6.0.4 -> 6.0.5
- jsdom: 30.0.0 -> 30.0.1
- lucide-react: 1.27.0 -> 1.28.0
- vite: 8.1.5 -> 8.2.0
- pnpm: 11.17.0 -> 11.18.0
jsdom 30.0.1 fixes the getComputedStyle() regression that 30.0.0 introduced for
CSS math functions, so patches/jsdom@30.0.0.patch and its patchedDependencies
entry are gone. packages/web/tests/jsdom-computed-style.test.ts stays and now
guards the upstream fix instead of the patch.
vally-cli 0.12.0 moves better-sqlite3 from 12.11.1 to 13.0.2 and adds koffi
3.1.3 through @github/copilot-sdk. Neither needs to run an install script.
better-sqlite3 13 ships per-platform binaries in prebuilds/ and its binding.gyp
resolves to a no-op target when one exists for the host, but node-gyp checks for
a C++ toolchain before it ever reads binding.gyp, so on Windows the implicit
rebuild fails on a package that has nothing to build. koffi loads its native
module from the @koromix/koffi-{platform}-{arch} optional dependency and only
falls back to cnoke when that's missing. All 15 of those platform packages are
in the lockfile, so Linux and macOS resolve the same way. Both are now
allowBuilds: false.
biome.json tracks the CLI version, so its $schema moves with the bump.
One moderate advisory stays open: @opentelemetry/core 2.0.0 reached only through
@microsoft/vally-cli > @azure/monitor-opentelemetry-exporter@1.0.0-beta.32 >
@opentelemetry/sdk-logs@0.200.0, which pins core exactly. The exporter's beta.44
already switched to caret ranges that resolve to core 2.9+, but beta.32 is the
version behind the latest dist-tag, so pnpm won't pick it up without an override
that jumps an Azure SDK prerelease past what upstream ships. It's dev-only eval
tooling with no connection string configured, and the fix belongs in vally-cli.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 322b4a6b-6ff1-4af4-a0e5-ee8f09b78c2c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates all workspace dependencies to latest stable.
Security
MCP SDK 1.30.0 moves
@hono/node-serverto 2.0.8, inside the unauthenticated WebSocket DoS range (GHSA-9mqv-5hh9-4cgg,>=2.0.0 <=2.0.9), and that's in the published CLI's production path. An override pins^2.0.12, which the SDK's^1.19.9 || ^2.0.5accepts.@opentelemetry/core2.0.0 stays open: moderate, dev-only, via@microsoft/vally-cli>@azure/monitor-opentelemetry-exporter@1.0.0-beta.32>@opentelemetry/sdk-logs@0.200.0, which pins core exactly. Exporter beta.44 fixed it with caret ranges, but beta.32 is thelatesttag, so the fix belongs in vally-cli.jsdom 30
30.0.0 threw from
getComputedStyle()for anycalc(),min(),max()orclamp()it couldn't reduce to a plain length, which took out every@testing-libraryrole query in a file. 30.0.1 fixes it upstream, so the local patch is gone andjsdom-computed-style.test.tsnow guards the upstream behaviour.Native install scripts
vally-cli 0.12.0 moves better-sqlite3 to 13.0.2 and adds koffi 3.1.3. Both ship per-platform binaries and neither needs to compile, so both are
allowBuilds: false. All 15@koromix/koffi-*packages are in the lockfile.Validation
3229 unit tests across 200 files, 20 e2e and a11y, 8 visual, plus
eval:lint.Validation: build, lint, typecheck, and tests all pass.