chore(security): close dependabot alerts q2 - #3456

Merged

nicktrn merged 15 commits into

mainfrom

security/dependabot-alerts-q2

Apr 28, 2026

Commits on Apr 27, 2026

chore(security): bump vite to 6.4.2 via override + drop unused root devDep
nicktrn
committed
bb71ea2
chore(security): dev-only overrides for rollup, flatted, picomatch, minimatch
nicktrn
committed
ea1d339
chore(security): override protobufjs + fast-xml-parser for critical CVEs
nicktrn
committed
3d2eae5
chore(security): bump existing overrides + dompurify direct dep
nicktrn
committed
e02e0de
chore: bump testcontainers + rimraf in dev/test deps
nicktrn
committed
4688261
chore(security): bump nodemailer 7 -> 8 for CRLF injection CVE
nicktrn
committed
9ef38cf
chore(security): bump uuid 9 -> 14 in webapp; drop unused uuid dep from sdk
nicktrn
committed
2409635
chore(security): bump tar in cli-v3 + override for supervisor k8s chain
nicktrn
committed
0bddd77
chore(security): override path-to-regexp 0.1.x for express 4 ReDoS
nicktrn
committed
3ca8f9f
chore(security): tighten override matchers + add ajv/socket.io-parser/postcss/yaml/semver/defu
nicktrn
committed
c5f2171
chore(security): bump effect 3.11 -> 3.21 in webapp for AsyncLocalStorage CVE
nicktrn
committed
47edc25
chore: regenerate lockfile for minimal diff against main
nicktrn
committed
5146f79
fix(testcontainers): convert stop() timeouts to ms for v11 + drop stale tar-fs override
nicktrn
committed
78bd3b9
fix(webapp): bundle uuid in remix server build + drop redundant @types/dompurify
nicktrn
committed
fb4e16b
chore(security): tighten lodash override lower bound to 4.17
nicktrn
committed
92eb872