Skip to content

chore(deps): remove glob override to resolve security vulnerabilities - #86

Open
natoscott wants to merge 1 commit into
mainfrom
deps/update-deprecations
Open

chore(deps): remove glob override to resolve security vulnerabilities#86
natoscott wants to merge 1 commit into
mainfrom
deps/update-deprecations

Conversation

@natoscott

@natoscott natoscott commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Remove the pinned glob@10.5.0 override from package.json to allow npm to resolve newer, patched versions and address high-severity security vulnerabilities.

Why: The override was unnecessarily restrictive and prevented transitive dependencies from pulling in security updates. Removing it allows glob to update to patched versions (10.3.10+) while maintaining compatibility.

Test plan

  • npm install completes successfully
  • All tests pass
  • Type checking passes
  • Linting passes

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Updated package configuration to retain the PostCSS version override while removing the Glob version override.

Remove the pinned `glob@10.5.0` override from package.json. This allows
npm to resolve newer, patched versions of glob and its dependent packages,
addressing the high-severity vulnerability reported in the npm audit.

The override was unnecessarily restrictive and prevented transitive
dependencies from pulling in security updates. Removing it allows:
- glob to update from 10.5.0 to patched versions (10.3.10+)
- rimraf@3.0.2 warning remains (transitive, would require eslint upgrade)
- eslint@8.57.1 still supported but in maintenance mode

Signed-off-by: Nathan Scott <nathans@redhat.com>
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f4b8aba9-2ec1-44a2-a950-eb9e7dc96c32

📥 Commits

Reviewing files that changed from the base of the PR and between 48865e3 and 0ffa05c.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (1)
  • package.json

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.


📝 Walkthrough

Walkthrough

The dependency override configuration removes the glob override and retains the postcss override.

Changes

Dependency override cleanup

Layer / File(s) Summary
Update dependency overrides
package.json
The glob override is removed. The postcss override remains.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🟡 Moderate · up to 0ffa0

The override removal may allow newer glob versions, but the dependency lock still contains a nested glob version whose advisory exposure has not been confirmed. Resolve that coverage before merging the security remediation.

Suggested reviewers: nb-qbits

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: removing the glob override to allow patched dependency versions and address security vulnerabilities.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch deps/update-deprecations

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

Parsing error: Missing semicolon. (2:8)


Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant