[FIX] Patch frontend Dependabot alerts (axios + transitive deps); drop unused package-lock.json#2038
[FIX] Patch frontend Dependabot alerts (axios + transitive deps); drop unused package-lock.json#2038jaseemjaskp wants to merge 1 commit into
Conversation
…p package-lock.json - axios 1.13.5 -> 1.16.0 (proxy-auth leak, prototype pollution, ReDoS) - raise caret floors above vulnerable versions: handlebars 4.7.9, js-cookie 3.0.8, happy-dom 20.10.2, vite 7.3.5, vitest 3.2.6 - add overrides for transitive deps: lodash/lodash-es 4.18.0, immutable 4.3.8, socket.io-parser 4.2.6, vite ^7.3.5 (dedupe vite-node) - remove frontend/package-lock.json: the prod image builds with 'bun install --frozen-lockfile' from bun.lock; the npm lockfile was unused and only caused drift + false Dependabot signals - gitignore package-lock.json/yarn.lock to prevent re-adds - repoint docker compose watch trigger to bun.lock
Frontend Lint Report (Biome)✅ All checks passed! No linting or formatting issues found. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (3)
Summary by CodeRabbitChores
WalkthroughThe PR standardizes the frontend to use Bun as the exclusive package manager. Docker compose watch configuration is updated to monitor ChangesBun package manager standardization and dependency updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
| Filename | Overview |
|---|---|
| frontend/package.json | Direct bumps (axios, handlebars, vite, vitest, happy-dom, js-cookie) correctly target vulnerable versions. The overrides block for immutable, socket.io-parser, and vite is correct. However, lodash/lodash-es are pinned to 4.18.0, which has a known regression; 4.18.1 is the correct safe version. |
| frontend/.gitignore | Adds package-lock.json and yarn.lock to gitignore with a clear comment directing developers to use bun exclusively; no issues. |
| docker/sample.compose.override.yaml | Updates the docker compose watch rebuild trigger from the now-deleted package-lock.json to bun.lock; correct and necessary change. |
| frontend/bun.lock | Regenerated lockfile reflects all the bumped direct deps and the overrides; confirms lodash@4.18.0 and lodash-es@4.18.0 are the versions currently installed. |
| frontend/package-lock.json | Deleted entirely; correct removal of an unused npm lockfile that was drifting from the canonical bun.lock. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[package.json\ndirect deps + overrides] --> B{bun install}
B -->|reads| C[bun.lock\nfrozen lockfile]
C --> D[node_modules]
subgraph overrides [Transitive Overrides]
O1[lodash 4.18.0 should be 4.18.1]
O2[lodash-es 4.18.0 should be 4.18.1]
O3[immutable 4.3.8]
O4[socket.io-parser 4.2.6]
O5[vite ^7.3.5]
end
A --> overrides
E[Docker build frontend.Dockerfile] -->|bun install --frozen-lockfile| C
F[package-lock.json deleted] -. was unused .-> G[No longer tracked gitignore updated]
H[compose watch trigger] -->|was package-lock.json now bun.lock| C
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
frontend/package.json:101-102
Both `lodash@4.18.0` and `lodash-es@4.18.0` have a known regression introduced in that exact release: `template.js` throws `ReferenceError: assignWith is not defined`, and `fromPairs` breaks when imported from modular builds (e.g. `lodash/fromPairs` or `lodash-es/fromPairs`). This was reported in [lodash/lodash#6167](https://github.com/lodash/lodash/issues/6167) and fixed in `4.18.1` (released April 1, 2026). At least one transitive dependency in this tree (`@react-awesome-query-builder/core`) imports lodash as a modular build and uses utilities like `fromPairs`, making a breakage during build or test plausible. Bump both overrides to `4.18.1`.
```suggestion
"lodash": "4.18.1",
"lodash-es": "4.18.1",
```
Reviews (1): Last reviewed commit: "[FIX] Patch frontend Dependabot alerts (..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| "lodash": "4.18.0", | ||
| "lodash-es": "4.18.0", |
There was a problem hiding this comment.
lodash@4.18.0 and lodash-es@4.18.0 have a known regression introduced in that exact release: template.js throws ReferenceError: assignWith is not defined, and fromPairs breaks when imported from modular builds (e.g. lodash/fromPairs or lodash-es/fromPairs). This was reported in lodash/lodash#6167 and fixed in 4.18.1 (released April 1, 2026). At least one transitive dependency in this tree (@react-awesome-query-builder/core) imports lodash as a modular build and uses utilities like fromPairs, making a breakage during build or test plausible. Bump both overrides to 4.18.1.
| "lodash": "4.18.0", | |
| "lodash-es": "4.18.0", | |
| "lodash": "4.18.1", | |
| "lodash-es": "4.18.1", |
Prompt To Fix With AI
This is a comment left during a code review.
Path: frontend/package.json
Line: 101-102
Comment:
Both `lodash@4.18.0` and `lodash-es@4.18.0` have a known regression introduced in that exact release: `template.js` throws `ReferenceError: assignWith is not defined`, and `fromPairs` breaks when imported from modular builds (e.g. `lodash/fromPairs` or `lodash-es/fromPairs`). This was reported in [lodash/lodash#6167](https://github.com/lodash/lodash/issues/6167) and fixed in `4.18.1` (released April 1, 2026). At least one transitive dependency in this tree (`@react-awesome-query-builder/core`) imports lodash as a modular build and uses utilities like `fromPairs`, making a breakage during build or test plausible. Bump both overrides to `4.18.1`.
```suggestion
"lodash": "4.18.1",
"lodash-es": "4.18.1",
```
How can I resolve this? If you propose a fix, please make it concise.
jaseemjaskp
left a comment
jaseemjaskp
left a comment
There was a problem hiding this comment.
Automated review (PR Review Toolkit). Scope is a focused frontend dependency patch (5 files). Verified: bun install --frozen-lockfile is the only install path (frontend.Dockerfile + CI all use bun), there are zero remaining references to package-lock.json or npm ci in the repo, and bun.lock carries a matching overrides block — so deleting the lockfile and adding it to .gitignore is safe. One forward-looking note below; the lodash@4.18.0 regression is already covered by greptile's thread, so not reposting it.
| "engines": { | ||
| "node": ">=20.19.0" | ||
| }, | ||
| "overrides": { |
There was a problem hiding this comment.
Verify each override maps to a real alert, and reconsider exact-pinning (complements greptile's lodash thread — not a duplicate).
Three distinct points on this new overrides block:
-
lodash/lodash-esoverride may be unnecessary. Before this PR the tree already resolvedlodash@4.17.23/lodash-es@4.17.23(see the bun.lock diff), which is past the4.17.21line that patched the known lodash prototype-pollution CVEs. Forcing4.18.0doesn't appear to close any alert that4.17.23left open — and per greptile it introduces a runtime regression. Worth confirming which Dependabot alert this override targets; if none, removing the two lodash overrides (letting it stay on the already-safe 4.17.x) is safer than greptile's bump-to-4.18.1. -
Exact pins freeze
immutable@4.3.8andsocket.io-parser@4.2.6against future patches. Unlikevite(^7.3.5), these are pinned exactly, so Dependabot/bun won't pick up a future4.2.7/4.3.9security fix without another manual PR. If the intent is to lock to a known-good version that's fine — just flagging the maintenance trade-off. -
Document the rationale. JSON can't carry comments, so consider noting in the PR description which alert each override resolves (
socket.io-parser≥4.2.4 for the parser advisory,immutable, etc.). It makes the next person's audit much faster.
2 participants
What
Patches the frontend critical/high Dependabot alerts and removes the unused
frontend/package-lock.json.axios1.13.5 → 1.16.0 (proxy-auth credential leak, prototype-pollution gadgets, ReDoS)handlebars4.7.9,js-cookie3.0.8,happy-dom20.10.2,vite7.3.5,vitest3.2.6overridesfor transitive deps that didn't dedupe:lodash/lodash-es4.18.0,immutable4.3.8,socket.io-parser4.2.6, andvite ^7.3.5(forcesvite-node's nested copy off the vulnerable 7.3.1)frontend/package-lock.json— the production image builds withbun install --frozen-lockfilefrombun.lock; the npm lockfile was installed by nothing and only caused lockfile drift + false Dependabot signalspackage-lock.json/yarn.lockto prevent accidental re-addsdocker compose watchrebuild trigger frompackage-lock.json→bun.lockWhy
The frontend had the bulk of the open critical/high npm Dependabot alerts (axios ×11, handlebars critical, vitest critical, vite, etc.). Two committed lockfiles (
bun.lock+package-lock.json) were drifting and onlybun.lockis actually used to build, so the npm one was both useless and misleading.How
bun add/updatefor the direct bumps,overridesinpackage.jsonfor transitive ones, then regeneratedbun.lock.bun install --frozen-lockfile --ignore-scripts(the prod Dockerfile's exact command) passes, andbun run buildsucceeds.Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)
No expected breakage.
package-lock.jsonremoval is safe: no Dockerfile or CI installs from it — the frontend image usesoven/bun+bun install --frozen-lockfileagainstbun.lock, and frontend CI only runs Biome (no install step).Database Migrations
None.
Env Config
None.
Relevant Docs
N/A
Related Issues or PRs
GitHub Dependabot alerts (frontend / npm). Follow-up PRs will cover the Python (
uv.lock) ecosystems.Dependencies Versions
axios 1.16.0 · handlebars 4.7.9 · js-cookie 3.0.8 · happy-dom 20.10.2 · vite 7.3.5 · vitest 3.2.6 · lodash/lodash-es 4.18.0 · immutable 4.3.8 · socket.io-parser 4.2.6
Known remaining (deferred, tracked separately)
picomatch@2.3.1(viahttp-proxy-middleware > micromatch) — bun has no scoped overrides; low risk (dev proxy tooling).tar@6.2.1(viajsdom > canvas > node-pre-gyp) — needs a major 6→7 bump behind an already-invalidcanvaspeer; handled separately.Notes on Testing
bun install --frozen-lockfile --ignore-scripts✓ (no lock drift)bun run build✓biome ci src/— pre-existing warnings only, no new issuesScreenshots
N/A — dependency/build-config only.
Checklist
I have read and understood the Contribution Guidelines.