Repository navigation
build(deps): remove vulnerable ESLint transitive dependencies - #541
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the
Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update dependency policy package.json, pnpm-workspace.yaml |
The ESLint development dependency range changes to ^9.39.5. The workspace adds an override for the Zod peer of abitype@0.8.7, removes several package overrides, and updates the release-age exclusions. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Suggested reviewers: humble-little-bear
Merge Risk: 
96db9
-
No actionable merge-blocking risk remains from the dependency policy changes.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly describes the main change: removing vulnerable transitive dependencies through an ESLint dependency upgrade. Description check The description directly explains the ESLint upgrade, dependency removals, security impact, remaining advisories, and validation results. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Summary
The locked ESLint 9.26.0 dependency brings in an unused MCP/HTTP server stack with multiple security advisories. Upgrade ESLint within v9 to 9.39.5, which no longer depends on that stack, and regenerate the pnpm 10 lockfile.
This removes the affected dependencies for 11 of the 13 currently open Dependabot alerts.
pnpm auditdrops from 16 advisories (4 high, 8 moderate, 4 low) to 2 low advisories, including removal of three newer advisories not yet listed by Dependabot.abitype@0.8.7's unused optional Zod peer using a scoped pnpm removal override. JoyID imports only abitype's ABI types; neither the CLI nor its SDK dependencies importabitype/zod. This removes vulnerable Zod 3 without forcing an incompatible Zod 4 API on abitype.Only
package.json,pnpm-workspace.yaml, andpnpm-lock.yamlchange. Direct runtime dependency versions stay the same.Remaining advisories
Both remaining packages have no patched release on npm; the audit intentionally continues to report them.
elliptic@6.6.1@ckb-ccc/core→@joyid/ckb→@nervosnetwork/ckb-sdk-utilsdeepmerge@4.3.1jest→@jest/core→jest-configValidation
Local validation with Node 24.8.0 and pnpm 10.28.2:
pnpm install --frozen-lockfile --offline— passes with the populated store.pnpm lint— passes with one existingno-explicit-anywarning insrc/node/install.ts.pnpm typecheck— passes.pnpm build— passes, including the CLI and Biscuit WASM artifacts.pnpm test:ci --runInBand— 57 suites passed; 559 tests passed, 7 skipped; coverage thresholds passed.--version/--helpsmoke checks — pass.pnpm whyconfirms the removed vulnerable packages are absent from the resolved graph.git diff --check— passes.pnpm audit— 2 low advisories remain, so its exit code is still 1.The existing TypeScript ESLint 7 / ESLint 9 peer-range warning remains; lint succeeds. This stays within ESLint v9 to keep a major toolchain migration outside this security fix.