Where the count stands
Bumping next (#412) took the repository from 104 open alerts to 60, exactly as predicted, and removed next from the list entirely. What is left is not a long tail — it is three transitive packages and a short remainder:
| Package |
Alerts |
Installed |
Fixes available |
Where |
dompurify |
18 |
3.2.7 |
3.3.2 … 3.4.13 |
frontend — transitive via monaco-editor@0.55.1 |
undici |
11 |
— |
7.28.0, 7.29.0 |
frontend, development scope only |
hono |
7 |
4.12.25 |
4.12.27, 4.12.34 |
backend-ts — transitive via @hono/node-server |
brace-expansion |
6 |
|
|
mixed |
postcss, js-yaml |
4 each |
|
|
mixed |
vite, nanoid, immutable |
2 each |
|
|
dev |
uuid and a short tail |
|
|
|
|
Why none of these has a Dependabot PR waiting
All three of the big ones are transitive. Dependabot's version updates propose changes to direct dependencies; a transitive one only moves when its parent moves or when the lockfile is forced.
hono additionally sits in backend-ts, which has no Dependabot updater at all — its pnpm workspace pulls members from a git submodule that Dependabot never initializes (#411 records the reproduction). So nothing will ever propose it automatically.
The likely shape of the fix
pnpm.overrides pinning the three to their patched versions, then a full verification pass. dompurify is worth checking rather than assuming: it comes from Monaco, which is the Studio's CQL editor, and a sanitizer bump inside an editor is exactly the kind of thing that is fine 99 times and breaks rendering the 100th.
Worth confirming before doing the work:
- Does
monaco-editor have a release that already carries a patched dompurify? Bumping the parent beats an override.
undici is dev-scope — it never ships. Confirm that before spending effort there; it may be worth suppressing rather than fixing.hono reaches us through @mieweb/cloud, so the honest fix may be upstream in MIE's repo rather than an override here.
Not urgent
None of these is in the request path of a deployed service with real data — the demo stack carries synthetic data only. This is hygiene, and it is worth doing carefully rather than quickly.
Where the count stands
Bumping
next(#412) took the repository from 104 open alerts to 60, exactly as predicted, and removednextfrom the list entirely. What is left is not a long tail — it is three transitive packages and a short remainder:dompurifyfrontend— transitive viamonaco-editor@0.55.1undicifrontend, development scope onlyhonobackend-ts— transitive via@hono/node-serverbrace-expansionpostcss,js-yamlvite,nanoid,immutableuuidand a short tailWhy none of these has a Dependabot PR waiting
All three of the big ones are transitive. Dependabot's version updates propose changes to direct dependencies; a transitive one only moves when its parent moves or when the lockfile is forced.
honoadditionally sits inbackend-ts, which has no Dependabot updater at all — its pnpm workspace pulls members from a git submodule that Dependabot never initializes (#411 records the reproduction). So nothing will ever propose it automatically.The likely shape of the fix
pnpm.overridespinning the three to their patched versions, then a full verification pass.dompurifyis worth checking rather than assuming: it comes from Monaco, which is the Studio's CQL editor, and a sanitizer bump inside an editor is exactly the kind of thing that is fine 99 times and breaks rendering the 100th.Worth confirming before doing the work:
monaco-editorhave a release that already carries a patcheddompurify? Bumping the parent beats an override.undiciis dev-scope — it never ships. Confirm that before spending effort there; it may be worth suppressing rather than fixing.honoreaches us through@mieweb/cloud, so the honest fix may be upstream in MIE's repo rather than an override here.Not urgent
None of these is in the request path of a deployed service with real data — the demo stack carries synthetic data only. This is hygiene, and it is worth doing carefully rather than quickly.