Bump vulnerable dev dependencies to patched versions#228
Merged
Conversation
Resolve 5 of 7 open Dependabot alerts (both criticals) with minimal patch and minor bumps instead of the major upgrades Dependabot proposed in #213: vitest and @vitest/* 3.2.4 -> 3.2.6, turbo 2.8.20 -> 2.9.14, and the picomatch override 4.0.3 -> 4.0.4. All target versions are more than 7 days old, so they clear CI's JFrog db-npm 7-day cooldown. The two esbuild alerts are deferred until esbuild 0.28.1 clears the cooldown; both are dev-build-tool issues (Deno integrity, dev server on Windows) that do not affect this repo. Co-authored-by: Isaac
Divyansh-db
approved these changes
Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps the vulnerable development dependencies to their minimal patched versions, resolving 5 of the 7 open Dependabot alerts — including both criticals:
vitestand@vitest/*^3.2.4 → ^3.2.6,turbo2.8.20 → 2.9.14, and thepicomatchoverride4.0.3 → 4.0.4.viteandesbuildare intentionally left untouched.Why
Seven Dependabot security alerts are open against the repository, all in development-scope tooling (none ship in any published
@databricks/sdk-*package). Dependabot's automatic security PR (#213) tried to resolve the vitest/esbuild cluster by upgradingvitestto 4.x andviteto 8.x — two major versions. That happens because, without anoverridespin, the only path that pulls patchedesbuild@0.28.1through the dependency tree is avitemajor. Those majors are higher risk (potential test-config migration) and, more immediately, target brand-new versions that CI's JFrogdb-npmregistry blocks under its 7-day "immature package" cooldown policy — so #213 fails every check atjf npm cibefore any test runs.The vulnerabilities do not actually require those majors. Each alert has a much smaller fix whose target version is already well past the 7-day cooldown window, so it installs cleanly in CI:
vitest/@vitest/browser/@vitest/coverage-v8are fixed in3.2.6(published 2026-06-01),turboin2.9.14(2026-05-14), andpicomatchin4.0.4(2026-03-23). This PR applies those minimal bumps directly and leavesviteon 6.x.The two remaining esbuild alerts (
GHSA-gv7w-rqvm-qjhr, high, Deno binary integrity;GHSA-g7r4-m6w7-qqqr, low, dev server on Windows) requireesbuild@0.28.1, which has not yet cleared the registry cooldown. They are deferred deliberately: both are dev-build-tool issues that do not affect this repository (no Deno usage; CI runs on Linux), and they can be picked up once0.28.1matures past the 7-day window.What changed
Interface changes
None.
Behavioral changes
None for SDK consumers. Every change is to development and test tooling.
Internal changes
vitest,@vitest/browser,@vitest/coverage-v8:^3.2.4 → ^3.2.6— resolvesGHSA-5xrq-8626-4rwp(critical, Vitest UI server arbitrary file read/exec) andGHSA-g8mr-85jm-7xhm(critical, Vitest Browser Mode API RCE).turbo:2.8.20 → 2.9.14— resolvesGHSA-hcf7-66rw-9f5r(medium, login callback CSRF) andGHSA-3qcw-2rhx-2726(low, local code execution during Yarn Berry detection).picomatchoverride:4.0.3 → 4.0.4— resolvesGHSA-3v7f-55p6-f55p(medium, method injection in POSIX character classes).package-lock.jsonregenerated to match.How is this tested?
Ran the full CI suite locally against the bumped versions; all stages pass:
build,lint+format:check,typecheck,test(Node.js),test:browser(chromium, 209 tests), andcheck:licenses.This PR changes only development and test dependencies and has no consumer-facing effect, so no changelog entry is required.
NO_CHANGELOG=true
This pull request and its description were written by Isaac.