Bump dashboard UI pins: tar, ip-address, react-router, postcss, brace-expansion, webpack-dev-server - #1096
Merged
Merged
Conversation
- tar resolution 7.5.16 -> 7.5.22: clears the new tar advisory batch (CVE-2026-59873 critical, CVE-2026-59874, CVE-2026-59875, CVE-2026-59871) - ip-address resolution 10.3.1 (was transitive 9.0.5): clears CVE-2026-42338 - react-router-dom 6.30.2 -> 6.30.4 (with @remix-run/router 1.23.3): clears CVE-2026-40181 on react-router All three are transitive or patch-level moves; dashboard yarn build verified locally.
Three more open Dependabot alerts on the same lockfile, all above the versions the existing pins carried: - postcss 8.5.23 clears CVE-2026-45623 (high, needs 8.5.12) and a second high advisory needing 8.5.18; the lock resolved 8.4.47/8.4.49 - brace-expansion 1.1.13 -> 1.1.16 for CVE-2026-13149 - webpack-dev-server 5.2.5 -> 5.2.6 for CVE-2026-14620 and CVE-2026-14631
kaidaguerre
changed the title
SumitPopat
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Open Dependabot alerts on
/ui/dashboardtransitive npm packages, none of which Dependabot can raise directly:What
Resolution changes in
ui/dashboard/package.json:tar7.5.16 → 7.5.22postcss8.5.23 — the lock resolved 8.4.47/8.4.49brace-expansion1.1.13 → 1.1.16webpack-dev-server5.2.5 → 5.2.6ip-address10.3.1 — the lock carried transitive 9.0.5react-router-dom6.30.2 → 6.30.4,@remix-run/router1.23.2 → 1.23.3Note: CVE-2026-53668 on react-router-dom itself has no fixed 6.x release (fix is the v7 major) — being snoozed in Vanta with auto-reopen, not addressed here.
Also note this supersedes the postcss fix in #1059, which only reaches 8.5.14 — below the 8.5.18 the high-severity advisory requires.
Verification
yarn installclean; lock confirms tar 7.5.22, postcss 8.5.23, brace-expansion 1.1.16, webpack-dev-server 5.2.6, ip-address 10.3.1, react-router + react-router-dom 6.30.4yarn build(craco production build) succeeds locally🤖 Generated with Claude Code