osv-scanner on pnpm-lock.yaml at main reports 12 packages with 16 high or critical advisories between them. Eight of the packages have a fixed release, so a dependency update removes their advisories.
@modelcontextprotocol/sdk goes from 1.29.0 to 1.32.0 in apps/server, and dompurify from 3.4.16 to 3.4.17 in apps/web. sharp goes from 0.35.4 to 0.35.5 in apps/marketing and scripts.seroval, shell-quote, proxy-addr, and source-map-js inside their parents' existing ranges. This changes the lockfile only.pnpm-workspace.yaml. @vercel/routing-utils pins path-to-regexp 6.1.0 exactly, even in its latest release, so the override moves it to 6.3.0.The lockfile diff contains only these packages and sharp's platform binaries.
Refs #23907, which lists every advisory with its CVE and where T3 Code uses the package. This PR fixes 8 of the 12 packages, and the issue tracks the other 4.
This is maintenance with no change to product behavior, and every bump is a patch or minor release. It fixes one problem: dependencies with published advisories. The advisories are public, so this uses a normal PR rather than the private security address.
Out of scope: braces, node-forge, and http-cache-semantics have no fixed release yet. uuid 7.0.3 under Expo's xcode needs a major bump, which belongs in its own PR.
osv-scanner on the new lockfile: 12 high or critical packages before, 4 after. The 4 are the out-of-scope packages above.apps/server: tsc --noEmit is clean. vp test run on the Claude adapter, provider, MCP app, MCP OAuth, and HTTP tests passes 260 of 260. A script ran a tool call through createSdkMcpServer from @anthropic-ai/claude-agent-sdk, which is the SDK's only consumer, on MCP SDK 1.32.0.apps/web: tsc --noEmit is clean and vp build succeeds. A local browser test rendered a real flowchart and a math diagram through both DOMPurify sanitizers in MermaidDiagram.tsx. The test failed when I made the sanitizer strip text or msup. The test is not in this PR because nothing in the repo currently covers those sanitizers, and that is a separate problem.apps/marketing: astro build succeeds and writes .webp images through sharp 0.35.5. scripts and alchemy's Cloudflare runtime both load the same single sharp 0.35.5.vercel.ts configs give identical getTransformedRoutes output with path-to-regexp 6.1.0 and 6.3.0.Not checked: desktop and mobile builds, and a real alchemy or Vercel deploy.
Done with Claude Opus 5.5 in Claude Code.
🤖 Generated with Claude Code
Review completed
Added 1 commit
Verdict: Needs Human Approval
Macroscope's review found this PR requires human approval — This is a focused dependency and lockfile update with no product-default or application-logic changes, but it directly remediates high and critical security advisories across server, web, routing, and image-processing paths. The security-sensitive purpose warrants human review.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review. 🎉
8cebcda1-c5f0-4ffd-b8e3-8426bc4ef6ffReviewing files that changed from the base of the PR and between 51273020db3245f4ec29514a419d29b5dcb012dc and 7494b70869550b7fa4cebbe952e8d23d14679d54.
pnpm-lock.yaml is excluded by !**/pnpm-lock.yamlapps/marketing/package.jsonapps/server/package.jsonapps/web/package.jsonpnpm-workspace.yamlscripts/package.jsonIncluded review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
The pull request updates dependencies in the marketing, server, web, and scripts packages. It also adds a workspace override for path-to-regexp used by @vercel/routing-utils.
Changes: Dependency updates
| Layer / File(s) | Summary |
|---|---|
Dependency versions and resolution apps/marketing/package.json, apps/server/package.json, apps/web/package.json, scripts/package.json, pnpm-workspace.yaml | Updates sharp to 0.35.5 in marketing and scripts, @modelcontextprotocol/sdk to 1.32.0, and dompurify to ^3.4.17. Adds an override that resolves path-to-regexp under @vercel/routing-utils to 6.3.0. |
Priority: ➖ Normal
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Other
Suggested reviewers: t3dotgg
7494bThe dependency updates have no identified merge-blocking risk; normal platform and deployment validation can follow standard checks.
| Check name | Status | Explanation |
|---|---|---|
| Title check | Passed | The title clearly identifies a dependency update intended to address high and critical security advisories. |
| Linked Issues check | Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | Passed | Check skipped because no linked issues were found for this pull request. |
| Description check | Passed | The description includes all required sections and provides clear problem, dependency changes, scope, approval reference, verification results, and unverified areas. It is complete and directly relate… |
Explanation
The description includes all required sections and provides clear problem, dependency changes, scope, approval reference, verification results, and unverified areas. It is complete and directly related to the pull request.
Comment @coderabbitai help to get the list of available commands.