Repository navigation
ci: patch the Vercel CLI's vulnerable dependencies - #11000
Conversation
vercel@64.0.2 pins tar, undici, js-yaml, minimatch, path-to-regexp, smol-toml, ajv and zod at versions with 33 known advisories, including a critical one in tar and a TLS certificate validation bypass in undici, the HTTP client that carries the deploy token. vercel@65.0.0 pins the same versions, so an upgrade does not help. npm overrides in .github/vercel-cli now move each library to a fixed release that is past the 7-day cooldown. All but undici 5 stay on their major version. undici 5 moves to 6.29.1, which also drops @fastify/busboy. npm audit goes from 33 advisories to 0, which clears the 51 Dependabot alerts on this lockfile. Tested with a real prebuilt preview deploy to vortex-explorer, installed with npm ci --ignore-scripts and run with the workflow's flags. The deploy reached READY, served the site and the wasm, and recorded its commit metadata. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Will Manning <will@willmanning.io>
Merging this PR will improve performance by 10.82%2 warnings
Performance Changes
Tip Curious why performance improved? Comment Comparing 
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
connortsui20
left a comment
connortsui20
left a comment
There was a problem hiding this comment.
surely we wont be victim to a supply chain attack!
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 064453bcec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This PR clears the 51 Dependabot alerts on
.github/vercel-cli/package-lock.json.npm auditgoes from 33 advisories to 0.vercel@64.0.2pins vulnerable versions of tar, undici, js-yaml, minimatch, path-to-regexp, smol-toml, ajv and zod. One tar advisory is critical. undici has a TLS validation bypass, and the deploy token goes through undici.vercel@65.0.0pins the same versions.npm
overridesset each library to a fixed release past the 7-day cooldown. Only undici 5 changes major, to 6.29.1.I made a real preview deploy with the patched CLI and the workflow flags. It worked.
🤖 Generated with Claude Code