Repository navigation
chore(deps): fix security vulnerabilities in frontend and backend dependencies - #121
Merged
Merged
Conversation
…endencies Frontend: - next 16.2.3 -> 16.4.3, eslint-config-next -> 16.4.3 - postcss 8.5.6 -> 8.5.32 - npm audit fix for transitive deps (axios, sharp, picomatch, zod, etc.) - npm audit: 20 vulnerabilities -> 0 Backend: - yt-dlp 2026.2.21 -> 2026.10.26 - requests ~=2.32.4 -> ~=2.34.2 - fastapi ~=0.128.0 -> ~=0.162.0 (pulls starlette 0.52.1 -> 1.10.0) - refresh transitive deps in uv.lock (urllib3, aiohttp, certifi, ...) - regenerate requirements.txt via uv export - pip-audit: 10 starlette vulnerabilities -> 0 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BcTvTdgFmfQ1xFv6A7AUir
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves the open dependency security alerts in both the frontend and the backend.
Frontend
next16.2.3 → 16.4.3,eslint-config-next→ 16.4.3postcss8.5.6 → 8.5.32npm audit fixfor vulnerable transitive deps (axios, sharp, picomatch, zod, source-map-js, etc.)npm audit: 20 vulnerabilities (1 critical, 13 high) → 0Backend
yt-dlp2026.2.21 → 2026.10.26requests~=2.32.4 → ~=2.34.2fastapi~=0.128.0 → ~=0.162.0, which brings instarlette0.52.1 → 1.10.0 (the patched starlette needs a newer fastapi)uv.lock(urllib3, aiohttp, certifi, …) and regeneratedrequirements.txtviauv export --no-hashes --frozenpip-audit: 10 starlette vulnerabilities → 0Supersedes the Renovate security PRs for next (#116), postcss (#112), yt-dlp (#117) and requests (#113).
Testing
next buildsucceeds;next startserves/,/share,/room/[roomId]with 200/callbackrejects a bad signature with 400 as expectedGenerated by Claude Code