René's URL Explorer Experiment


Title: chore(security): patch pnpm audit vulnerabilities via overrides by jamesbhobbs · Pull Request #368 · deepnote/deepnote · GitHub

Open Graph Title: chore(security): patch pnpm audit vulnerabilities via overrides by jamesbhobbs · Pull Request #368 · deepnote/deepnote

X Title: chore(security): patch pnpm audit vulnerabilities via overrides by jamesbhobbs · Pull Request #368 · deepnote/deepnote

Description: Summary Bumps pnpm.overrides in the root package.json so that pnpm audit reports zero known vulnerabilities. All 13 advisories (3 high, 10 moderate) are addressed without touching application code — only transitive versions change. Overrides added defu >=6.1.5 — GHSA-737v-mqg7-c878 (prototype pollution; pulled in via tsdown>unconfig) vite >=7.3.2 — GHSA-v2wj-q39q-566r, GHSA-p9ff-h696-f583, GHSA-4w7w-66w2-5vf9 (server.fs.deny bypass, dev-server WS arbitrary file read, optimized-deps path traversal; via vite-tsconfig-paths) brace-expansion >=5.0.5 — GHSA-f886-m6hf-6m8v (zero-step sequence DoS; the existing @isaacs/brace-expansion override is a different package name and did not cover this transitive) postcss >=8.5.10 — GHSA-qx2v-qp2m-jg93 (XSS via unescaped ) Overrides bumped hono: >=4.12.7 → >=4.12.14 — fixes GHSA-26pp-8wgv-hjvm, GHSA-r5rp-j6wh-rvv4, GHSA-xf4j-xp2r-rqqx, GHSA-wmmm-f939-6g9c, GHSA-458j-xx4x-4375, GHSA-xpcf-pg52-r92g @hono/node-server: >=1.19.10 → >=1.19.13 — GHSA-92pp-h63x-v22m (middleware bypass via repeated slashes) Other changes cspell.json: added defu to the dictionary so the spell-check pre-push hook passes. Test plan pnpm install succeeds pnpm audit reports No known vulnerabilities found CI green (typecheck, build, test) Spot-check that nothing in packages/mcp breaks at the new hono major-minor (it stays within 4.12.x) 🤖 Generated with Claude Code Summary by CodeRabbit Chores Updated project dependencies to newer stable versions, including core frameworks and build tools, for improved security and performance.

Open Graph Description: Summary Bumps pnpm.overrides in the root package.json so that pnpm audit reports zero known vulnerabilities. All 13 advisories (3 high, 10 moderate) are addressed without touching application code ...

X Description: Summary Bumps pnpm.overrides in the root package.json so that pnpm audit reports zero known vulnerabilities. All 13 advisories (3 high, 10 moderate) are addressed without touching application code ...

Opengraph URL: https://github.com/deepnote/deepnote/pull/368

X: @github

direct link

Domain: github.com

react-profiling0
react-import-mapreact,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf
route-pattern/:user_id/:repository/pull/:id/files/:range(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:54feefb5-551c-95d1-6846-48d488b07e98
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idE50A:105FCA:A155F4:D6301D:6AEDCF15
html-safe-nonce66166f58f631d64e6e95b945134446417f5d80e41d1e18290f39c37b2e6a3c54
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFNTBBOjEwNUZDQTpBMTU1RjQ6RDYzMDFEOjZBRURDRjE1IiwidmlzaXRvcl9pZCI6IjU0MTMxMjAzMzM0NzAwOTMwNzciLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmacc94bcea14ae451b8e8a025faf5f5701fac847776f4b0692c9dd2cd583be27a3e
hovercard-subject-tagpull_request:3608954152
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
twitter:imagehttps://avatars.githubusercontent.com/u/15235276?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/15235276?s=400&v=4
og:image:altSummary Bumps pnpm.overrides in the root package.json so that pnpm audit reports zero known vulnerabilities. All 13 advisories (3 high, 10 moderate) are addressed without touching application code ...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
Nonef60373873bb1ef795e8511ea1f2a76997e9c649d72b02942aedf2def3423a0ce
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/deepnote/deepnote git https://github.com/deepnote/deepnote.git
octolytics-dimension-user_id45339858
octolytics-dimension-user_logindeepnote
octolytics-dimension-repository_id1066509034
octolytics-dimension-repository_nwodeepnote/deepnote
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id1066509034
octolytics-dimension-repository_network_root_nwodeepnote/deepnote
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release0f55cfa61438c7dc93d1024a1e5e5182b36830e2
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#start-of-content
https://github.com/
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fdeepnote%2Fdeepnote%2Fpull%2F368%2Ffiles%2F589b890b2a4f90939562d19bc42ca3645a76401a
GitHubRepository hosting, code review, and collaborationhttps://github.com/platform
CopilotAI coding agent for tasks, projects, and automated workhttps://github.com/features/copilot
ActionsCI/CD and automationhttps://github.com/features/actions
Code QualityQuality analysis, fixes, and enforcementhttps://github.com/features/code-quality
CodespacesCloud development environmentshttps://github.com/features/codespaces
Code SecurityVulnerability detection and remediationhttps://github.com/security/advanced-security/code-security
Secret ProtectionSecret scanning and leak preventionhttps://github.com/security/advanced-security/secret-protection
All Featureshttps://github.com/features
Documentationhttps://docs.github.com/en
Traininghttps://learn.github.com/skills
Certificationshttps://learn.github.com/credentials
Build with Copilothttps://github.com/features/ai
Customize Copilothttps://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-copilot-overview
Integrationshttps://github.com/marketplace
Trending reposhttps://github.com/trending
GitHub Sponsorshttps://github.com/open-source/sponsors
Developer articleshttps://github.com/resources/articles
ChangelogYour source for the latest features, improvements, and fixes across GitHub products, all in one place.https://github.blog/changelog/
Enterpriseshttps://github.com/enterprise
Teamhttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
See all industrieshttps://github.com/solutions/industry
Why GitHubhttps://github.com/why-github
Customer Storieshttps://github.com/customer-stories
Business insightshttps://github.com/solutions/executive-insights
Trust Centerhttps://github.com/trust-center
GitHub Advanced SecurityEnterprise-grade code securityhttps://github.com/security/advanced-security
Copilot for businessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Documentationhttps://docs.github.com/en
Resource centerhttps://github.com/resources
Bloghttps://github.blog/
Events & webinarshttps://github.com/resources/events
Community Forumhttps://github.com/orgs/community/discussions
Customer Storieshttps://github.com/customer-stories
Integrationshttps://github.com/marketplace
Customer supporthttps://help.github.com/
Traininghttps://learn.github.com/skills
GitHub Statushttps://www.githubstatus.com/
Abouthttps://github.com/about
Partnershttps://github.com/partners
Changeloghttps://github.blog/changelog/
GitHub UniverseThe event for developers, by developers — talks, workshops, and what’s next for GitHub.https://githubuniverse.com/
Pricinghttps://github.com/pricing
Sign inhttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fdeepnote%2Fdeepnote%2Fpull%2F368%2Ffiles%2F589b890b2a4f90939562d19bc42ca3645a76401a
Sign uphttps://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=deepnote%2Fdeepnote
Reloadhttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
Reloadhttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
Reloadhttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
deepnotehttps://github.com/deepnote
deepnotehttps://github.com/deepnote/deepnote
Codehttps://github.com/deepnote/deepnote
Issues14 (14)https://github.com/deepnote/deepnote/issues
Pull requests24 (24)https://github.com/deepnote/deepnote/pulls
Discussionshttps://github.com/deepnote/deepnote/discussions
Actionshttps://github.com/deepnote/deepnote/actions
Security and qualityhttps://github.com/deepnote/deepnote/security
Insightshttps://github.com/deepnote/deepnote/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fdeepnote%2Fdeepnote%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fdeepnote%2Fdeepnote%2Fissues%2Fnew%2Fchoose
jamesbhobbshttps://github.com/jamesbhobbs
mainhttps://github.com/deepnote/deepnote/tree/main
security/audit-patch-overrideshttps://github.com/deepnote/deepnote/tree/security/audit-patch-overrides
Conversation 6 https://github.com/deepnote/deepnote/pull/368
Commits 2 https://github.com/deepnote/deepnote/pull/368/commits
Checks 20 https://github.com/deepnote/deepnote/pull/368/checks
Files changed https://github.com/deepnote/deepnote/pull/368/files
Please reload this pagehttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
chore(security): patch pnpm audit vulnerabilities via overrides https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#top
Show all changes 2 commits https://github.com/deepnote/deepnote/pull/368/files
feb2965 chore(security): patch pnpm audit vulnerabilities via overrides jamesbhobbs Apr 30, 2026 https://github.com/deepnote/deepnote/pull/368/commits/feb29657f95ff72a5a1e76fb62fdc3be62e8b65d
589b890 chore: add 'defu' to cspell dictionary jamesbhobbs Apr 30, 2026 https://github.com/deepnote/deepnote/pull/368/commits/589b890b2a4f90939562d19bc42ca3645a76401a
Clear filters https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
Please reload this pagehttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
Please reload this pagehttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
cspell.json https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-77519f787fe7e051a14c588f101d61e4d8f0d3b01bf8e16cb65d3838243d4e68
package.json https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
pnpm-lock.yaml https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-32824c984905bb02bc7ffcef96a77addd1f1602cff71a11fbbfdd7f53ee026bb
https://github.com/deepnote/deepnote/blob/main/.github/CODEOWNERS#L2
cspell.jsonhttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-77519f787fe7e051a14c588f101d61e4d8f0d3b01bf8e16cb65d3838243d4e68
View file https://github.com/deepnote/deepnote/blob/589b890b2a4f90939562d19bc42ca3645a76401a/cspell.json
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/deepnote/deepnote/pull/368/files/{{ revealButtonHref }}
https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-77519f787fe7e051a14c588f101d61e4d8f0d3b01bf8e16cb65d3838243d4e68
https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-77519f787fe7e051a14c588f101d61e4d8f0d3b01bf8e16cb65d3838243d4e68
https://github.com/deepnote/deepnote/blob/main/.github/CODEOWNERS#L2
package.jsonhttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
View file https://github.com/deepnote/deepnote/blob/589b890b2a4f90939562d19bc42ca3645a76401a/package.json
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/deepnote/deepnote/pull/368/files/{{ revealButtonHref }}
https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
Please reload this pagehttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
https://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519
Please reload this pagehttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
Please reload this pagehttps://github.com/deepnote/deepnote/pull/368/files/589b890b2a4f90939562d19bc42ca3645a76401a
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.