Skip to content

Update ui deps sync#694

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/ui-deps-sync
Open

Update ui deps sync#694
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/ui-deps-sync

Conversation

@renovate

@renovate renovate Bot commented Oct 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@openzeppelin/confidential-contracts (source) ^0.3.1 → ^0.4.1 age adoption passing confidence
@rollup/plugin-commonjs (source) ^28.0.8 → ^28.0.9 age adoption passing confidence
@rollup/plugin-replace (source) ^6.0.2 → ^6.0.3 age adoption passing confidence
@rollup/plugin-typescript (source) ^12.1.4 → ^12.3.0 age adoption passing confidence
@types/node (source) ^20.19.21 → ^20.19.43 age adoption passing confidence
@upstash/redis (source) 1.35.6 → 1.38.0 age adoption passing confidence
@upstash/redis (source) 1.35.6 → 1.38.0 age adoption passing confidence
autoprefixer ^10.4.21 → ^10.5.0 age adoption passing confidence
jszip 3.6.0 → 3.10.1 age adoption passing confidence
postcss (source) ^8.5.6 → ^8.5.15 age adoption passing confidence
semver ^7.7.3 → ^7.8.4 age adoption passing confidence
tailwindcss (source) ^3.4.18 → ^3.4.19 age adoption passing confidence

Release Notes

OpenZeppelin/openzeppelin-confidential-contracts (@​openzeppelin/confidential-contracts)

v0.4.1

Compare Source

Bug Fixes
  • BatcherConfidential: Enable decryption of the joinedAmount in BatcherConfidential. (#​387)

v0.4.0

Compare Source

  • Migrate @fhevm/solidity dependency to 0.11.1 (#​311)
  • Upgrade openzeppelin/contracts and openzeppelin/contracts-upgradeable to v5.6.1 (#​314)
Token
  • ERC7984ERC20Wrapper: use a bytes32 unwrap request identifier instead of identifying batches by the euint64 unwrap amount. (#​326)
  • ERC7984ERC20Wrapper: Support ERC-165 interface detection on ERC7984ERC20Wrapper. (#​267)
  • ERC7984ERC20Wrapper: return the amount of wrapped token sent on wrap calls. (#​307)
  • ERC7984ERC20Wrapper: return unwrapped amount on unwrap calls (#​288)
  • ERC7984ERC20Wrapper: revert on wrap if there is a chance of total supply overflow. (#​268)
  • ERC7984Restricted, ERC7984Rwa: Rename isUserAllowed to canTransact (#​291)
Finance
  • BatcherConfidential: A batching primitive that enables routing between two ERC7984ERC20Wrapper contracts via a non-confidential route. (#​293)
Utils
  • HandleAccessManager: change _validateHandleAllowance to return a boolean and validate it. (#​303)
rollup/plugins (@​rollup/plugin-commonjs)

v28.0.9

2025-10-24

Bugfixes
  • fix: handle node: builtins with strictRequires: auto (#​1930)
rollup/plugins (@​rollup/plugin-replace)

v6.0.3

2025-10-29

Bugfixes
  • fix: update delimiters to respect valid js identifier chars (#​1938)
rollup/plugins (@​rollup/plugin-typescript)

v12.3.0

2025-10-23

Features
  • feat: expose latest Program to transformers in watch mode (#​1923)

v12.2.0

2025-10-22

Features
  • feat: process .js when allowJs is enabled (#​1920)
upstash/redis-js (@​upstash/redis)

v1.38.0

Compare Source

Minor Changes
  • c71f581: Separate read/write commands into separate pipelines in auto pipeline. As a
    result, mixed read/write Promise.all batches may now be split across multiple
    pipeline HTTP requests instead of a single request, and read-after-write
    ordering may no longer be preserved within those mixed batches.

v1.37.0

Compare Source

Minor Changes
Patch Changes

v1.36.4

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.36.3...v1.36.4

v1.36.3

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.2...v1.36.3

v1.36.2

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.1...v1.36.2

v1.36.1

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.0...v1.36.1

v1.36.0

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.35.8...v1.36.0

v1.35.8

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.35.7...v1.35.8

v1.35.7

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.35.6...v1.35.7

postcss/autoprefixer (autoprefixer)

v10.5.0

Compare Source

  • Added mask-position-x and mask-position-y support (by @​toporek).

v10.4.27

Compare Source

  • Removed development key from package.json.

v10.4.26

Compare Source

  • Reduced package size.

v10.4.25

Compare Source

  • Fixed broken gradients on CSS Custom Properties (by @​serger777).

v10.4.24

Compare Source

  • Made Autoprefixer a little faster (by @​Cherry).

v10.4.23

Compare Source

v10.4.22

Compare Source

  • Fixed stretch prefixes on new Can I Use database.
  • Updated fraction.js.
Stuk/jszip (jszip)

v3.10.1

Compare Source

  • Add sponsorship files.
    • If you appreciate the time spent maintaining JSZip then I would really appreciate your sponsorship.
  • Consolidate metadata types and expose OnUpdateCallback #​851 and #​852
  • use const instead var in example from README.markdown #​828
  • Switch manual download link to HTTPS #​839

Internals:

v3.10.0

Compare Source

  • Change setimmediate dependency to more efficient one. Fixes #​617 (see #​829)
  • Update types of currentFile metadata to include null (see #​826)

v3.9.1

Compare Source

  • Fix recursive definition of InputFileFormat introduced in 3.9.0.

v3.9.0

Compare Source

  • Update types JSZip#loadAsync to accept a promise for data, and remove arguments from new JSZip() (see #​752)
  • Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions (see #​722)
  • Add types for generateInternalStream (see #​774)

v3.8.0

Compare Source

  • Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.

v3.7.1

Compare Source

  • Fix build of dist files.
    • Note: this version ensures the changes from 3.7.0 are actually included in the dist files. Thanks to Evan W for reporting.

v3.7.0

Compare Source

  • Fix: Use a null prototype object for this.files (see #​766)
    • This change might break existing code if it uses prototype methods on the .files property of a zip object, for example zip.files.toString(). This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.
postcss/postcss (postcss)

v8.5.15

Compare Source

  • Fixed declaration parsing performance (by @​homanp).

v8.5.14

Compare Source

v8.5.13

Compare Source

  • Fixed postcss-scss commend regression.

v8.5.12

Compare Source

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

v8.5.11

Compare Source

  • Fixed nested brackets parsing performance (by @​offset).

v8.5.10

Compare Source

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

v8.5.9

Compare Source

  • Speed up source map encoding paring in case of the error.

v8.5.8

Compare Source

  • Fixed Processor#version.

v8.5.7

Compare Source

  • Improved source map annotation cleaning performance (by CodeAnt AI).
npm/node-semver (semver)

v7.8.4

Compare Source

Bug Fixes

v7.8.3

Compare Source

Bug Fixes
Chores

v7.8.2

Compare Source

Bug Fixes

v7.8.1

Compare Source

Bug Fixes

v7.8.0

Compare Source

Features
Bug Fixes
Documentation
Chores

v7.7.4

Compare Source

Bug Fixes
Documentation
Dependencies
Chores
tailwindlabs/tailwindcss (tailwindcss)

v3.4.19

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from a team as a code owner October 17, 2025 02:41
@socket-security

socket-security Bot commented Oct 17, 2025 •
edited
Loading

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Critical
Critical CVE: npm shell-quote quote() does not escape newlines in object .op values

CVE: GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values (CRITICAL)

Affected versions: >= 1.1.0 < 1.8.4

Patched version: 1.8.4

From: ? → npm/concurrently@9.2.0 → npm/shell-quote@1.8.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/shell-quote@1.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm lodash vulnerable to Code Injection via `_.template` imports key names

CVE: GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via _.template imports key names (HIGH)

Affected versions: >= 4.0.0 < 4.18.0

Patched version: 4.18.0

From: ? → npm/concurrently@9.2.0 → npm/lodash@4.17.21

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lodash@4.17.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

CVE: GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (HIGH)

Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.4

Patched version: 3.1.4

From: ? → npm/eslint@9.33.0 → npm/minimatch@3.1.2

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@3.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

CVE: GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (HIGH)

Affected versions: >= 10.0.0 < 10.2.1; >= 9.0.0 < 9.0.6; >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.4.7; >= 6.0.0 < 6.2.1; >= 5.0.0 < 5.1.7; >= 4.0.0 < 4.2.4; < 3.1.3

Patched version: 3.1.3

From: ? → npm/eslint@9.33.0 → npm/minimatch@3.1.2

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@3.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

CVE: GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (HIGH)

Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.3

Patched version: 3.1.3

From: ? → npm/eslint@9.33.0 → npm/minimatch@3.1.2

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@3.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

CVE: GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (HIGH)

Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.3

Patched version: 9.0.7

From: ? → npm/typescript-eslint@8.39.1 → npm/minimatch@9.0.5

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

CVE: GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (HIGH)

Affected versions: >= 10.0.0 < 10.2.3; >= 9.0.0 < 9.0.7; >= 8.0.0 < 8.0.6; >= 7.0.0 < 7.4.8; >= 6.0.0 < 6.2.2; >= 5.0.0 < 5.1.8; >= 4.0.0 < 4.2.5; < 3.1.4

Patched version: 9.0.7

From: ? → npm/typescript-eslint@8.39.1 → npm/minimatch@9.0.5

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

CVE: GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (HIGH)

Affected versions: >= 10.0.0 < 10.2.1; >= 9.0.0 < 9.0.6; >= 8.0.0 < 8.0.5; >= 7.0.0 < 7.4.7; >= 6.0.0 < 6.2.1; >= 5.0.0 < 5.1.7; >= 4.0.0 < 4.2.4; < 3.1.3

Patched version: 9.0.6

From: ? → npm/typescript-eslint@8.39.1 → npm/minimatch@9.0.5

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimatch@9.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Picomatch has a ReDoS vulnerability via extglob quantifiers

CVE: GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers (HIGH)

Affected versions: >= 4.0.0 < 4.0.4; >= 3.0.0 < 3.0.2; < 2.3.2

Patched version: 2.3.2

From: ? → npm/rollup-plugin-styles@4.0.0 → npm/picomatch@2.3.1

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/picomatch@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: Rollup 4 has Arbitrary File Write via Path Traversal

CVE: GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal (HIGH)

Affected versions: < 2.80.0; >= 3.0.0 < 3.30.0; >= 4.0.0 < 4.59.0

Patched version: 4.59.0

From: packages/ui/package.json → npm/rollup@4.52.4

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rollup@4.52.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: The code represents a conventional, non-obfuscated part of AJV’s custom keyword support. No direct malicious actions are evident within this module. Security concerns mainly arise from the broader supply chain: the external rule implementation (dotjs/custom), the definition schema, and any user-supplied keyword definitions. The dynamic compilation path (compile(metaSchema, true)) should be exercised with trusted inputs. Recommended follow-up: review the contents of the external modules and monitor the inputs supplied to addKeyword/definitionSchema to ensure no unsafe behavior is introduced during validation or data handling.

Confidence: 1.00

Severity: 0.60

From: ? → npm/eslint@9.33.0 → npm/ajv@6.12.6

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@6.12.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: The code implements a standard AJV-like dynamic parser generator for JTD schemas. There are no explicit malware indicators in this fragment. The primary security concern is the dynamic code generation and execution from external schemas, which introduces a medium risk if schemas are untrusted. With trusted schemas and proper schema management, the risk is typically acceptable within this pattern.

Confidence: 1.00

Severity: 0.60

From: ? → npm/@modelcontextprotocol/sdk@1.29.0 → npm/ajv@8.18.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: The code implements standard timestamp validation with clear logic for normal and leap years and leap seconds. There is no network, file, or execution of external code within this isolated fragment. The only anomalous aspect is assigning a string to validTimestamp.code, which could enable external tooling to inject behavior in certain environments, but this does not constitute active malicious behavior in this isolated snippet. Overall, low to moderate security risk in typical usage; no malware detected within the shown code.

Confidence: 1.00

Severity: 0.60

From: ? → npm/@modelcontextprotocol/sdk@1.29.0 → npm/ajv@8.18.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ajv is 100.0% likely to have a medium risk anomaly

Notes: This module generates JavaScript code at runtime via standaloneCode(...) and then immediately executes it with require-from-string. Because the generated code can incorporate user-supplied schemas or custom keywords without sanitization or sandboxing, an attacker who controls those inputs could inject arbitrary code and achieve remote code execution in the Node process. Users should audit and lock down the standaloneCode output or replace dynamic evaluation with a safer, static bundling approach.

Confidence: 1.00

Severity: 0.60

From: ? → npm/@modelcontextprotocol/sdk@1.29.0 → npm/ajv@8.18.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ajv@8.18.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm esquery is 100.0% likely to have a medium risk anomaly

Notes: The analyzed file is a legitimate PEG.js-generated parser module. It does not exhibit malicious exfiltration, backdoors, or external I/O mechanisms. The main security consideration is the potential risk around RegExp construction from user input, which should be mitigated by downstream code validating or constraining the resulting patterns. Overall, the security posture of this module is low risk when considered in isolation, with attention recommended for how parsed regexes are subsequently used by the host application.

Confidence: 1.00

Severity: 0.60

From: ? → npm/eslint@9.33.0 → npm/eslint-plugin-unicorn@61.0.2 → npm/esquery@1.6.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esquery@1.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm fs-extra is 100.0% likely to have a medium risk anomaly

Notes: The code is a standard filesystem utility that ensures a file exists by creating necessary directories and then writing an empty file. There is no evidence of malicious behavior, data exfiltration, or remote activity. The unusual ENOTDIR triggering is a defensive error path, not a backdoor or covert channel. Overall risk is low; functionality is as expected for a helper library in a filesystem module.

Confidence: 1.00

Severity: 0.60

From: ? → npm/rollup-plugin-styles@4.0.0 → npm/fs-extra@10.1.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fs-extra@10.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm js-yaml is 100.0% likely to have a medium risk anomaly

Notes: The code fragment represents a mature YAML parser/dumper (js-yaml) with standard security safeguards. It reads input, parses into structured JS objects, and can serialize objects back to YAML, with explicit protections against common deserialization hazards (e.g., prototype pollution). There is no evidence of malicious activity such as data exfiltration, embedded backdoors, or network activity. Primary concerns are generic YAML deserialization risks (DoS/memory usage) inherent to YAML loaders, which should be mitigated by using safe loading paths, input size limits, and schema controls.

Confidence: 1.00

Severity: 0.60

From: ? → npm/eslint@9.33.0 → npm/js-yaml@4.1.0

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm lodash is 100.0% likely to have a medium risk anomaly

Notes: This is a legitimate template compiler implementation that uses dynamic code generation (Function constructor) and optional 'with' scope. It is not malicious by intent in the provided fragment, but it exposes typical high-risk behaviors: arbitrary code execution via evaluate delimiters, potential XSS from unescaped interpolation, and broader attack surface if untrusted templates or imports are used. Use only with trusted templates or ensure strict delimiter/escaping policies. No evidence of backdoor, exfiltration, or obfuscated malicious payloads found in the provided code.

Confidence: 1.00

Severity: 0.60

From: ? → npm/concurrently@9.2.0 → npm/lodash@4.17.21

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lodash@4.17.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm openai is 100.0% likely to have a medium risk anomaly

Notes: The script itself is not evidently malicious but poses a moderate-to-high supply-chain risk: it invokes npx to download and execute a GitHub-hosted tarball and passes a local migration-config.json path and the process environment to the remote code. That remote code could perform arbitrary actions, read local configuration or environment secrets, or exfiltrate data. Mitigations: avoid using tarball URLs in runtime invocations, pin to vetted packages in package.json, verify integrity (checksums/signatures), vendor the migration tool or require an explicit local installation, and avoid passing sensitive file paths or environment variables to untrusted code.

Confidence: 1.00

Severity: 0.60

From: packages/ui/package.json → npm/openai@5.23.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/openai@5.23.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm picomatch is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a legitimate, sophisticated glob-to-regex parser (part of picomatch). There is no evidence of malicious behavior, data exfiltration, or backdoors within this fragment. While performance considerations exist due to backtracking and complex state management, and there is a potential for regex-related denial-of-service with pathological inputs, these concerns pertain to usage and input quality rather than intrinsic malware. Overall security risk is low to moderate depending on input handling and option usage; no active threats detected in the provided code alone.

Confidence: 1.00

Severity: 0.60

From: ? → npm/rollup-plugin-styles@4.0.0 → npm/picomatch@2.3.1

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/picomatch@2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm prettier is 100.0% likely to have a medium risk anomaly

Notes: No definitive malware detected in this fragment. The main security concern is supply-chain risk from dynamically loading plugins from potentially untrusted sources. To mitigate, enforce strict plugin provenance, disable remote plugin loading, verify plugin integrity, and apply least-privilege execution for plugins.

Confidence: 1.00

Severity: 0.60

From: package.json → npm/prettier@3.6.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/prettier@3.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm rxjs is 100.0% likely to have a medium risk anomaly

Notes: The code is a conventional, well-scoped implementation of an RxJS-like concat operator. No malicious behavior, data exfiltration, or suspicious I/O detected in this fragment. Security risk is low; malware likelihood is negligible for this isolated operator function.

Confidence: 1.00

Severity: 0.60

From: ? → npm/concurrently@9.2.0 → npm/rxjs@7.8.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rxjs@7.8.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm synckit is 100.0% likely to have a medium risk anomaly

Notes: The code is a sophisticated, legitimate utility for managing worker threads with various TypeScript runtimes and global shims. It does not exhibit explicit malicious behavior, hardcoded secrets, or standard malware patterns. The main security considerations relate to the safe handling of workerPath/globalShims inputs and ensuring that only trusted, validated worker code is executed in worker contexts. Overall risk is moderate due to the dynamic nature of code loading, but the fragment itself is a standard, non-malicious utility module.

Confidence: 1.00

Severity: 0.60

From: ? → npm/eslint-plugin-prettier@5.5.4 → npm/synckit@0.11.11

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/synckit@0.11.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Potential code anomaly (AI signal): npm ts-node is 100.0% likely to have a medium risk anomaly

Notes: The analyzed code is a standard, non-malicious portion of a ts-node-like runtime that handles TypeScript transpilation, source map support, and ESM/CJS interop. It does not exhibit malware or nefarious data-leak patterns within this fragment. The security risk is low to moderate, with notable caveats around error swallowing and heavy dynamic loading that warrant broader project review.

Confidence: 1.00

Severity: 0.60

From: packages/cli/package.json → npm/ts-node@10.9.2

ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/ts-node@10.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 2 more rows in the dashboard

View full report

@coderabbitai

coderabbitai Bot commented Oct 17, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 4e03dfd6-03dc-4b8f-941e-203546542fae

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

Package.json devDependencies updated: @types/node from ^20.19.21 to ^20.19.22 and rollup from ^4.52.4 to ^4.52.5. These are patch version updates with no runtime behavior changes.

Changes

Cohort / File(s) Summary
DevDependency version updates
packages/ui/package.json		 @types/node: ^20.19.21 → ^20.19.22; rollup: ^4.52.4 → ^4.52.5

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

Suggested reviewers

  • ericglau
  • collins-w
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title Check ✅ Passed The title "Update ui deps sync" is directly related to the changeset, which updates dependencies in the packages/ui/package.json file (@types/node and rollup versions). The title accurately indicates the primary change involves updating UI package dependencies, and a teammate scanning the commit history would understand this is about dependency updates for the UI package. While the term "sync" is somewhat informal and could be more explicit about which dependencies are affected, the title is sufficiently clear and specific to describe the main change.
Docstring Coverage ✅ Passed No functions found in the changes. Docstring coverage check skipped.
Description check ✅ Passed The PR description provides a comprehensive list of dependency updates with version changes, release notes, and configuration details related to the changeset.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/ui-deps-sync

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate Bot changed the title Update dependency @types/node to ^20.19.22 Update ui deps sync Oct 18, 2025
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 6 times, most recently from 48f60b5 to 3a00523 Compare October 24, 2025 14:45
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 8 times, most recently from 8c719e6 to e42c08d Compare November 3, 2025 20:14
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 12 times, most recently from c81f512 to 2acb5f1 Compare November 12, 2025 04:13
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 11 times, most recently from fe2dd45 to 0fd8ede Compare December 15, 2025 13:19
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 2 times, most recently from 684b39e to 04ee6c9 Compare December 20, 2025 13:58
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 2 times, most recently from 2992cb2 to 83401de Compare December 31, 2025 14:05
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 6 times, most recently from c61a046 to 482fee9 Compare January 10, 2026 11:30
@renovate renovate Bot force-pushed the renovate/ui-deps-sync branch 7 times, most recently from c613545 to f5e265c Compare January 19, 2026 11:00
@socket-security

socket-security Bot commented Jun 11, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​changesets/​changelog-github@​0.5.11001006793100
Addedtypescript-eslint@​8.39.11001007498100
Addedhighlightjs-cairo@​0.4.0741008079100
Added@​types/​semver@​7.7.11001007581100
Addedfile-saver@​2.0.510010010075100
Addedpath-browserify@​1.0.11001008575100
Addedopenai@​5.23.27910010099100
Added@​types/​file-saver@​2.0.71001008080100
Added@​types/​resize-observer-browser@​0.1.111001008380100
Addedsirv-cli@​3.0.19910010080100
Addedtippy.js@​6.3.7981009280100
Addedrollup-plugin-livereload@​2.0.59910010080100
Addedrollup-plugin-styles@​4.0.09710010080100
Updated@​types/​node@​24.5.1 ⏵ 20.19.10100 +11008196 +1100
Updated@​types/​node@​24.5.1 ⏵ 20.19.43100 +11008196 +1100
Addedpostcss-load-config@​6.0.110010010082100
Addedts-node@​10.9.29610010082100
Addedpostcss@​8.5.151001008291100
Addedhighlightjs-solidity@​2.0.6951008483100
Added@​rollup/​plugin-json@​6.1.010010010084100
Addedhighlight.js@​11.11.19910010084100
Added@​rollup/​plugin-alias@​5.1.110010010085100
Added@​rollup/​plugin-replace@​6.0.310010010085100
Addedrollup@​4.52.4978510098100
Addedutil@​0.12.51001008585100
Added@​rollup/​plugin-node-resolve@​16.0.39910010085100
Addedeslint-plugin-unicorn@​61.0.29910010086100
Addedautoprefixer@​10.5.01001008986100
Added@​rollup/​plugin-typescript@​12.3.09910010086100
Addedeslint-config-prettier@​10.1.810010010087100
Added@​eslint/​js@​9.33.01001009188100
Addedtypescript@​5.9.2100100909590
Added@​rollup/​plugin-commonjs@​28.0.99910010092100
See 11 more rows in the dashboard

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants