chore(deps): clear the open Dependabot advisories - #26
Merged
Conversation
GitHub reported 155 open alerts (8 critical, 53 high); pnpm audit counted 133. None of them reached SDK consumers — the published package's whole production tree is 15 packages (algokit-utils, @hey-api/client-fetch, the algosdk peer and their transitives) and not one of them appeared in an advisory. Every alert was in build, test or example tooling. Down to one, which has no fix available: - Refreshed everything resolvable inside the existing ranges, which cleared 96 of them, vitest's critical UI advisory among them. - The examples were on vite 4, which is out of support and accounted for the whole remaining high/critical cluster (vite itself, esbuild, and the crypto-browserify chain behind pbkdf2, sha.js and elliptic). Moved them to vite 7 with @vitejs/plugin-react 5 and vite-plugin-node-polyfills 0.28. - @hey-api/openapi-ts 0.64 -> 0.99 for its own prototype-pollution advisory and the tar chain under it. The generator's output is unchanged in this commit; `pnpm generate` will produce a 0.99 diff worth reviewing on its own. - Added pnpm overrides pinning ajv, js-yaml, lodash and minimatch to their patched versions. All four are transitive with no direct dependency to bump, and each override is range-scoped so it cannot drag a dependent across a major. Left: elliptic, low severity, no patched version published. It is reachable only as examples > vite-plugin-node-polyfills > node-stdlib-browser > crypto-browserify > browserify-sign > elliptic, in apps that are private and never published. Two knock-on fixes the updates forced: - typescript-eslint 8.67 resolves a relative parserOptions.project against the workspace root rather than process.cwd(), so every package's './tsconfig.json' pointed at a file that does not exist and lint failed with TS5012 on all 33 source files. Each config now sets tsconfigRootDir to its own directory. - prettier 3.9 reflows three files. No logic changed. The one range that reaches consumers is @hey-api/client-fetch, ^0.8.1 -> ^0.8.4, which the old range already permitted. pnpm run ci passes end to end: 246 tests, SDK build, and all ten example builds on vite 7.
pbennett
added a commit
that referenced
this pull request
Aug 28, 2026
The generator was bumped to 0.99 with #26 but its output was left at 0.64, so this is the regeneration that bump deferred. openapi-ts no longer consumes a separate client package: it emits its own fetch runtime into src/api/client and src/api/core. Nothing imports @hey-api/client-fetch any more, so it is dropped from dependencies and from the rollup externals. The published package now has one runtime dependency, @algorandfoundation/algokit-utils, plus the algosdk peer. Operation names now track the spec's operationIds verbatim - nfd_getLookup rather than nfdGetLookup. Only src/api-client.ts imports them and nothing generated is re-exported from src/index.ts, so the renames are internal. The public type surface is unchanged. src/types.ts pulls four types out of the generated output - NfdRecord, NfdSearchV2Response, VerifyConfirmResponseBody and VerifyRequestResponseBody - and all four are identical once doc comments are stripped. 0.99 emits the shared schema's description in place of the property's, which changes hover text and nothing else. Three supporting fixes, each of which blocked the regeneration: - openapi3.yaml moved out of src/api to sit beside openapi-ts.config.ts. 0.99 cleans its output directory before every run, so the spec was deleted by the generator that reads it, and generate:openapi failed on the second run with "Input file not found". It is gitignored, matching the fact that it is fetched from the private nfd-backend repo and was never committed. - The eslint and prettier ignores matched src/api/*.gen.ts, which no longer covers client/ and core/. The eslint post-processor failed the generate step on explicit-function-return-type in the emitted runtime, and the package-level prettier ignore silenced openapi-ts's own formatting pass, so the first successful run landed unformatted. eslint now skips src/api entirely and the generator formats its own output. - output.format and output.lint are deprecated in favour of postProcess. eslint is deliberately not in the list. Verified against the live API rather than the mocks, since the HTTP client underneath changed: search, resolve, and reverse lookup all return real data, including the repeated-address query serialisation and the 404 path that reverseLookup swallows per chunk. pnpm run ci passes: 246 tests, SDK build, all ten example builds.
Contributor
|
🎉 This PR is included in version 2.0.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub reported 155 open alerts (8 critical, 53 high, 64 moderate, 30 low);
pnpm auditcounted 133. This takes it to 1, which has no fix available.First, the part that matters least and reads worst
None of these reached SDK consumers. The published package's entire production tree is 15 packages:
Not one of them appeared in an advisory. Every alert was build, test or example tooling — which is why the count could sit at 155 without anything shipping vulnerable.
What changed
@vitejs/plugin-react4 → 5,vite-plugin-node-polyfills0.23 → 0.28@hey-api/openapi-ts0.64 → 0.99ajv,js-yaml,lodash,minimatchThe in-range refresh alone cleared 96, including vitest's critical UI advisory (
< 3.2.6).The examples were on vite 4, out of support, and accounted for the whole remaining high/critical cluster — vite itself,
esbuild, and thecrypto-browserifychain behindpbkdf2,sha.jsandelliptic.The four overrides are all transitive with no direct dependency to bump. Each is range-scoped (
"minimatch@<3.1.4": "^3.1.4") so it patches without dragging a dependent across a major — a bare"minimatch": ">=3.1.4"would have resolved to 10.x.What's left
elliptic, low severity, no patched version published (patched_versions: <0.0.0). Reachable only as:Example apps are
private: trueand never published. Nothing to do until upstream ships a fix.Two knock-on fixes the updates forced
typescript-eslint 8.67 changed how it resolves
parserOptions.project. A relative path now resolves against the workspace root rather thanprocess.cwd(), so every package's'./tsconfig.json'pointed at a file that does not exist and lint failed withTS5012on all 33 SDK source files (and every example). Each config now setstsconfigRootDir: import.meta.dirname.prettier 3.9 reflows three files — two example
App.tsxandtypes.ts. Union-type and boolean-expression line breaking only; no logic changed.One range reaches consumers
@hey-api/client-fetch^0.8.1→^0.8.4, a runtime dependency. The old range already permitted 0.8.4, so anyone installing today resolves the same version; this only raises the floor.@hey-api/openapi-ts's generated output is unchanged here — the bump is to the generator, andsrc/api/*.gen.tsstill comes from 0.64. Runningpnpm generatewill produce a 0.99 diff that deserves review on its own rather than riding along in a dependency PR.Verification
pnpm run cipasses end to end locally: lint, format:check, typecheck, 246 tests, SDK build, and all ten example builds on vite 7.This is a
chore:commit, so it publishes nothing.