⬆️(dependencies) fix security advisories in dependencies#773
Merged
kernicPanel merged 5 commits intoJul 22, 2026
Conversation
kernicPanel
force-pushed
the
fix/security-dependency-updates
branch
from
July 9, 2026 11:45
48cf6e4 to
7cd5830
Compare
There was a problem hiding this comment.
Pull request overview
This PR resolves multiple dependency security advisories by upgrading key frontend build/runtime tooling (Next.js, Vite, Turbo) and aligning the lockfiles, plus updating the backend container base image and a Python transitive dependency.
Changes:
- Bump Next.js to
15.5.18(and corresponding@next/*lock entries). - Bump Vite to
6.4.3and Turbo to2.9.14(including updated Turbo platform packages in the lockfile). - Update backend deps by upgrading
idnato3.18and move the Docker base image topython:3.13.14-alpine.
Reviewed changes
Copilot reviewed 5 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
src/frontend/yarn.lock |
Updates lockfile entries for Next.js 15.5.18, Vite 6.4.3, and Turbo 2.9.14 (incl. Turbo platform packages). |
src/frontend/packages/sdk/package.json |
Pins vite to 6.4.3 for the SDK package build tooling. |
src/frontend/package.json |
Upgrades workspace-level turbo devDependency to 2.9.14. |
src/frontend/apps/sdk-consumer/package.json |
Updates vite to 6.4.3 for the SDK consumer app. |
src/frontend/apps/drive/package.json |
Updates next to 15.5.18 for the Drive frontend app. |
src/backend/uv.lock |
Updates idna to 3.18 in the backend lockfile. |
Dockerfile |
Updates the base image to python:3.13.14-alpine. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
kernicPanel
force-pushed
the
fix/security-dependency-updates
branch
from
July 21, 2026 13:53
7cd5830 to
8913156
Compare
Next 15.5.18, Vite 6.4.3 and Turbo 2.9.14 patch several advisories: Next.js server components denial of service (GHSA-26hh-7cqf-hhc6), Vite server.fs.deny bypass (GHSA-fx2h-pf6j-xcff) and Turbo local code execution on untrusted repositories (GHSA-3qcw-2rhx-2726).
Rebase the backend image on python:3.13.14-alpine (Alpine 3.24) to pull the patched openssl fixing CVE-2026-31789. Stays within the pinned 3.13 runtime, so no dependency re-resolution is needed.
Bump the transitive idna to 3.18 to fix GHSA-65pc-fj4g-8rjx, where crafted input to idna.encode() bypasses the CVE-2024-3651 mitigation.
Bump django to 5.2.15 to fix GHSA-mm6v-q8q9-pgcf.
Raise the transitive pillow constraint to 12.3.0 to fix CVE-2026-54058 (GHSA-pg7v-jwj7-p798), flagged by the trivy scan on the backend image.
kernicPanel
force-pushed
the
fix/security-dependency-updates
branch
from
July 21, 2026 16:40
cbdb1d8 to
380525a
Compare
|
NathanVss
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Close several open Dependabot security advisories in one go, resolving
the shared frontend lockfile a single time to avoid the mutual conflicts
between the individual Renovate PRs (#705, #744, #714).
Proposal
patched openssl (CVE-2026-31789), staying on the pinned 3.13 runtime
Supersedes #705, #744, #714, #741 and #775 (#741 kept the 3.13 runtime
instead of jumping to 3.14). The mjml/js-cookie advisory is deliberately
left out for a dedicated PR, as the v5 bump is a major on the mail
template build.