Skip to content

fix: resolve npm security vulnerabilities (28 → 12) - #35

Open
AryanKpr wants to merge 1 commit into
mainfrom
feature/issue-4-package-updates
Open

fix: resolve npm security vulnerabilities (28 → 12)#35
AryanKpr wants to merge 1 commit into
mainfrom
feature/issue-4-package-updates

Conversation

@AryanKpr

@AryanKpr AryanKpr commented Aug 2, 2026

Copy link
Copy Markdown
Collaborator

📋 PR Overview

Summary

Fixed (16 vulnerabilities):

  • critical: tar
  • high: brace-expansion, flatted, js-yaml, jws, lodash, minimatch, picomatch, ws
  • moderate: ajv, mdast-util-to-hast, qs, uuid

Remaining 12 cannot be fixed without breaking changes:

  • next/postcss/sharp: locked by @LlamaIndex peer deps
  • undici/@ai-sdk: locked by ai package version
  • prismjs: locked by react-syntax-highlighter

Type of Change

  • [✅ ] 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [ ✅] 🔧 Configuration change (changes to build, CI, or configuration files)
  • 📚 Documentation update (changes to documentation only)
  • 🎨 UI/UX improvement (styling, layout, or user experience changes)
  • ⚡ Performance improvement (code changes that improve performance)
  • 🧹 Code cleanup/refactoring (non-functional changes that improve code quality)

QA Instructions

  1. Run npm audit to verify count dropped from 28 to 12
  2. Run npm run dev to verify app still compiles

Related Issues

localStorage SSR error is pre-existing on main branch, unrelated to this PR

Fixed (16 vulnerabilities):
- critical: tar
- high: brace-expansion, flatted, js-yaml, jws,
  lodash, minimatch, picomatch, ws
- moderate: ajv, mdast-util-to-hast, qs, uuid

Remaining 12 cannot be fixed without breaking changes:
- next/postcss/sharp: locked by @LlamaIndex peer deps
- undici/@ai-sdk: locked by ai package version
- prismjs: locked by react-syntax-highlighter

Closes #4
@vercel

vercel Bot commented Aug 2, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nexus Error Error Aug 2, 2026 5:40am

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Package Maintenance and Updates

1 participant