fix(deps): clear babel, react-router, sharp, and esbuild advisories

[reachjalil]

Summary

Clears 11 Dependabot advisories (3 high, 6 medium, 2 low) across four dependency groups. No breaking migrations — the two version bumps are within-major, and the rest are transitive overrides.

Change	Alerts	Kind
react-router-dom ^7.14.1 → ^7.18.2	7	direct bump
esbuild overrides (×2)	2	transitive override
sharp 0.34.5 → 0.35.3 (den-api)	1	direct bump
@babel/core override → 7.29.6	1	transitive override

Touches 4 files: two package.json, pnpm-workspace.yaml, and the lockfile. No source changes.

react-router-dom → 7.18.2

Clears 7 advisories, including 3 high. This is a within-v7 bump, not the React Router 8 migration the alerts imply — usage in apps/app is entirely declarative (useNavigate ×16, useParams, useSearchParams, Routes/Route/HashRouter/BrowserRouter), with no data-router, loader, or action APIs involved.

esbuild → 0.25.12 / 0.28.1

"esbuild@<0.25.0": 0.25.12
"esbuild@>=0.27.3 <0.28.1": 0.28.1

Both copies were transitive and build-time only. The <0.25.0 case was esbuild@0.18.20, reached via drizzle-kit → @esbuild-kit/esm-loader → @esbuild-kit/core-utils@3.3.2. Note that @esbuild-kit/core-utils is deprecated ("merged into tsx") and pins esbuild: ~0.18.20, so this override deliberately forces it off its declared range — see verification below. Upgrading drizzle-kit is not an alternative: the latest (0.31.10) still depends on @esbuild-kit/esm-loader.

The second override is in-range for its consumer (vite@7.3.6 accepts ^0.27.0 || ^0.28.0).

sharp → 0.35.3

0.35 has a real breaking-change list, but none of it touches den-api's usage in brand-assets.ts and mcp/tool-content.ts, which is limited to resize, jpeg, png, metadata, and toBuffer. The removed APIs (failOnError, paletteBitDepth, jp2k, deprecated sharpen properties) are unused. Requires Node ≥20.9.

@babel/core → 7.29.6

Transitive only (@vitejs/plugin-react, @sentry/bundler-plugin-core, styled-jsx, shadcn). This advisory previously had no released fix.

Why the lockfile diff is net negative

The lockfile shows ~469 insertions against ~845 deletions. This is expected and is a side effect of the esbuild override consolidating duplicate copies:

before: esbuild@0.18.20, 0.25.12, 0.27.2, 0.28.0, 0.28.1   (5 versions)
after:  esbuild@0.25.12, 0.28.1                            (2 versions)

Dropping three esbuild versions removes ~22 per-platform @esbuild/* packages each. Additions are mostly sharp's @img/sharp-* platform binaries. pnpm install --frozen-lockfile passes, confirming the lockfile is in sync with the manifests.

Verification

All performed locally with the pinned pnpm@11.4.0, on the current dev base:

• pnpm install --frozen-lockfile — passes (lockfile in sync)
• apps/app production build and tests — 646 pass, 2 fail
• ee/packages/den-db tests — 13 pass, 0 fail (exercises the drizzle-kit → esbuild-kit chain)
• drizzle-kit CLI runs (v0.31.9, drizzle-orm v0.45.2) under the forced esbuild
• @esbuild-kit/core-utils confirmed resolving esbuild@0.25.12 and its transform API verified working — this is the check that matters, since the override breaks its pin
• sharp@0.35.3 smoke-tested against den-api's exact API surface (resize/jpeg/png/metadata/toBuffer) — correct output
• ee/apps/den-api build, ee/apps/den-web typecheck, ee/apps/landing Next production build — all pass

Pre-existing failures (verified identical on unmodified dev)

• The 2 apps/app message-list loading feedback test failures.
• The ee/apps/landing wrapper build failing check-connect-installer-parity.mjs, which is why the Next build was invoked directly. Already noted in fix(deps): clear compatible security advisories #3500.

Known residuals

• sharp lockfile alert persists. After this change the only vulnerable copy left is sharp@0.34.5 pulled in by Next.js for image optimization. Next 15.5.21 declares ^0.34.3 and Next 16.2.11 declares ^0.34.5, so forcing 0.35.x would push Next outside its tested range — deliberately not done here.
• hono → 4.12.34 (6 alerts) excluded. Blocked by the repository's age policy: pnpm rejects it with ERR_PNPM_NO_MATURE_MATCHING_VERSION until 2026-08-06T02:36Z. Best paired with the @hono/node-server v2 bump.
• xlsx (4 alerts) excluded. It is not an unused dependency — it is loaded via await import("xlsx") in apps/app/src/react-app/domains/session/artifacts/artifact-spreadsheet-model.ts. npm's latest is still 0.18.5, so clearing it needs a SheetJS-CDN source or a library migration, which has on-prem/airgapped build implications and deserves its own decision.
• react-router alert GHSA-qwww-vcr4-c8h2 is unfixable within v7 (needs react-router@8.3.0; react-router-dom has no v8), but the advisory applies only to the unstable RSC APIs, which apps/app does not use — a not_used dismissal.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 5, 2026 9:02am
openwork-den	Ready	Preview	Aug 5, 2026 9:02am
openwork-den-worker-proxy	Ready	Preview	Aug 5, 2026 9:02am
openwork-diagnostics	Ready	Preview	Aug 5, 2026 9:02am
openwork-landing	Ready	Preview, v0	Aug 5, 2026 9:02am

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (3e5fcbfab03a631afdfc71be29f8e6b63026341d). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (e2e0de62920f7d011efee2bc513916e3f1d5298e). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (55ecd51ebd2c0c60b6194cb435988c3b0e38d9fa). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run