You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Closes the remaining findings from the dependency audit. PR #297 took Next to 16 and PR #298 moved the toolchain to Node 24 / pnpm 11; this is the rest — two live advisories, the full drift sweep, and eight majors.
No user-facing changes.
What changed
Security — lodash 4.18.1 (GHSA-r5fr-rjxr-66jc) and drizzle-orm 0.45.2 (GHSA-gpj5-g38j-94v9). Both were inside existing ranges; neither was reachable in our code, but they cleared scanners.
Removed — @storybook/blocks (dead since SB9, unused), babel-loader (no webpack config since #297), @babel/preset-react and @babel/plugin-transform-private-methods (both redundant under Babel 8), @eslint/eslintrc, @storybook/addon-onboarding. npm-run-all → npm-run-all2.
Drift — Apollo, Chakra, recharts, react-hook-form, libsql and the usual patch/minor set.
Code changes
Only three, all forced by a major:
Address.tsx / PoolHeader.tsx — Chakra 3.37's useBreakpointValue infers from the first entry and rejects a mixed {base:'1.688rem', sm:5} map. Fixed with an explicit <string | number> generic, which keeps the spacing token rather than hardcoding a rem value.
jest.config.js — react-ga4 3 ships ESM-only .mjs, which the transform pattern didn't match. Added mjs.
eslint.config.mjs — ESLint 10 removed --ext, so the lint script changed; the eslintrc compat layer was replaced with native flat configs.
The other 327 files are mechanical: 241 from the prettier 3 reformat (its own commit), 86 from the Storybook 10 story-import codemod (its own commit).
Deliberate debt
eslint-plugin-react-hooks v7 enables the React Compiler rules in its recommended preset — 55 errors against current code (set-state-in-effect ×41, plus purity, immutability, refs, use-memo). All 14 are disabled behind a TODO(deps-sweep) marker. That's a separate piece of work about how components use effects and refs, not a dependency bump.
eslint-plugin-react 7.37.5 has no ESLint 10 support at all (peers cap at ^9.7, and it calls the removed context.getFilename()), so an @eslint/compat shim stays until it ships one.
Reviewer notes
Commit 5 (Chakra UI to 3.37) is the one to read. Everything else is dependency metadata or a codemod.
Prettier is split into a bump commit and a formatting-only commit, so the reformat can be skimmed.
lint output is unchanged throughout: 75 warnings, 0 errors, same three rules, verified commit by commit.
TypeScript stops at 6.0.3 — the ecosystem isn't past it yet.
Verification
Full CI sequence green from a frozen install: format:check, lint, 128 suites / 618 tests, next build, build-storybook.
Beyond CI, the ENS cron path was run against live infrastructure — one request exercising graphql 17, Apollo, ethers and drizzle/libsql together: 742 entries refreshed in 7.5s through a single 742-alias subgraph query, 73 ENS names and 27 avatars persisted.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/drizzle-orm@0.45.2. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency file
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the remaining findings from the dependency audit. PR #297 took Next to 16 and PR #298 moved the toolchain to Node 24 / pnpm 11; this is the rest — two live advisories, the full drift sweep, and eight majors.
No user-facing changes.
What changed
Security —
lodash4.18.1 (GHSA-r5fr-rjxr-66jc) anddrizzle-orm0.45.2 (GHSA-gpj5-g38j-94v9). Both were inside existing ranges; neither was reachable in our code, but they cleared scanners.Majors — prettier 3, ESLint 10, TypeScript 6, Storybook 10, Vite 8, jotai 3, framer-motion 13, graphql 17, Babel 8, react-ga4 3, jest-dom 7, dotenv-cli 11, Chromatic 18.
Removed —
@storybook/blocks(dead since SB9, unused),babel-loader(no webpack config since #297),@babel/preset-reactand@babel/plugin-transform-private-methods(both redundant under Babel 8),@eslint/eslintrc,@storybook/addon-onboarding.npm-run-all→npm-run-all2.Drift — Apollo, Chakra, recharts, react-hook-form, libsql and the usual patch/minor set.
Code changes
Only three, all forced by a major:
Address.tsx/PoolHeader.tsx— Chakra 3.37'suseBreakpointValueinfers from the first entry and rejects a mixed{base:'1.688rem', sm:5}map. Fixed with an explicit<string | number>generic, which keeps the spacing token rather than hardcoding a rem value.jest.config.js— react-ga4 3 ships ESM-only.mjs, which the transform pattern didn't match. Addedmjs.eslint.config.mjs— ESLint 10 removed--ext, so the lint script changed; the eslintrc compat layer was replaced with native flat configs.The other 327 files are mechanical: 241 from the prettier 3 reformat (its own commit), 86 from the Storybook 10 story-import codemod (its own commit).
Deliberate debt
eslint-plugin-react-hooksv7 enables the React Compiler rules in its recommended preset — 55 errors against current code (set-state-in-effect×41, pluspurity,immutability,refs,use-memo). All 14 are disabled behind aTODO(deps-sweep)marker. That's a separate piece of work about how components use effects and refs, not a dependency bump.eslint-plugin-react7.37.5 has no ESLint 10 support at all (peers cap at^9.7, and it calls the removedcontext.getFilename()), so an@eslint/compatshim stays until it ships one.Reviewer notes
Chakra UI to 3.37) is the one to read. Everything else is dependency metadata or a codemod.lintoutput is unchanged throughout: 75 warnings, 0 errors, same three rules, verified commit by commit.Verification
Full CI sequence green from a frozen install:
format:check,lint, 128 suites / 618 tests,next build,build-storybook.Beyond CI, the ENS cron path was run against live infrastructure — one request exercising graphql 17, Apollo, ethers and drizzle/libsql together: 742 entries refreshed in 7.5s through a single 742-alias subgraph query, 73 ENS names and 27 avatars persisted.