mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Jordan Ritter
f1f3f07514
## Summary Comprehensive security vulnerability sweep via pnpm overrides and devDep bumps. Reduces audit from **155+ to 3** unfixable vulnerabilities. ### Changes **49 pnpm overrides** covering all resolvable transitive dependency vulnerabilities: - 12 initial overrides (phase 1) - 7 upgraded to higher patched versions (phase 2) - 30 new overrides added (phase 3) **Direct dependency bumps:** - storybook devDeps: ^10.1.10 → ^10.2.10 (root + react storybook example) - vitest in demo-agents: ^2.1.8 → ^4.1.3 (resolves vite 5.x vuln) - next in chat-with-your-data: 15.6.0-canary.58 → 15.6.0-canary.61 - vite in react-router: ^6.0.0 → ~7.3.2 ### Remaining 3 (truly unfixable) | Package | Severity | Why | |---------|----------|-----| | parse-git-config | HIGH | No patch exists (patched: <0.0.0), dep of danger | | elliptic | LOW | No patch exists, deep in storybook crypto chain | | next | MODERATE | Example on 15.x canary, advisory needs 16.x | ### Companion PR ag-ui-protocol/ag-ui#1504 Part of CPK-7320