chore(deps): clear all open Dependabot security alerts#5429
Closed
leaanthony wants to merge 9 commits into
Closed
Conversation
- v2/go.mod, v3/go.mod, webview2/scripts/go.mod: bump
golang.org/x/{crypto,net,image} and github.com/go-git/go-git/v5
to patched versions (GHSA-*, dependabot alerts)
- v2/examples/*, v3/examples/*, v3/tests/*: bump transitive deps
- v2/examples/dragdrop-test/go.mod: remove stale `replace` directive
pointing to Windows-only dev path E:/releases/wails/v2
v2/internal/frontend/runtime: - happy-dom ^7.6.0 -> ^20.0.0 (CRITICAL: GHSA-37j7-fg3j-429f, VM context escape RCE) - esbuild ^0.15.6 -> ^0.27.0 - svelte ^3.49.0 -> ^5.0.0 (test-env dev dep, not used for compile) - vitest ^0.24.3 -> ^3.0.0 - regenerated package-lock.json + rebuilt bundles v2/internal/frontend/runtime/dev: - esbuild ^0.12.17 -> ^0.27.0 - esbuild-svelte and svelte kept at compile-compatible versions; remaining svelte SSR-XSS advisories are non-applicable (client-only reconnect overlay, no SSR, no contenteditable bindings) and will be dismissed as not_used. v3/internal/runtime/desktop/@wailsio/runtime: - happy-dom ^17.1.1 -> ^20.0.0 (CRITICAL: GHSA-37j7-fg3j-429f) - vite ^5.2.0 -> ^7.0.0 - vitest ^3.0.6 -> ^3.2.0 - typedoc ^0.27.7 -> ^0.28.0 - rimraf ^5.0.5 -> ^6.0.1 - overrides for serialize-javascript (>=7.0.5) and diff (>=8.0.2) to break transitive vuln chain via promises-aplus-tests -> mocha/sinon
All 12 templates in v2/pkg/templates/templates/ had vite^3.0.7 which is flagged by ~8 Dependabot advisories (path traversal, server.fs.deny bypasses). Bumped to vite^7.0.0 across the board. Framework bumps for templates that scaffold new projects: - svelte^3 -> ^5, @sveltejs/vite-plugin-svelte^1 -> ^6, @tsconfig/svelte^3 -> ^5, svelte-check^2 -> ^4, dropped svelte-preprocess (no longer needed under svelte 5 + plugin-svelte 6) - react^18 -> ^19, @vitejs/plugin-react^2 -> ^5 - vue^3.2 -> ^3.5, @vitejs/plugin-vue^3 -> ^6, vue-tsc^1 -> ^2 - lit^2 -> ^3 - preact^10.10 -> ^10.24, @preact/preset-vite^2.3 -> ^2.10 - typescript^4 -> ^5.6 everywhere
All v2/examples/*/frontend and v3/examples/*/frontend bumped vite to ^7.0.0 to clear Dependabot path-traversal and server.fs.deny advisories. Additional bumps for TS-typed examples: - typescript ^4.9.3 -> ^5.6.3 (badge, badge-custom, dock, notifications) - @sveltejs/vite-plugin-svelte ^2 -> ^6 and svelte ^3 -> ^5 (v3/examples/dev) Lockfiles regenerated for all dirs that had package-lock.json.
- @crowdin/cli ^3.19.4 -> ^4.14.2 (clears tar < 7.5.11 advisory chain) - @crowdin/crowdin-api-client ^1.33.1 -> ^1.55.1 - prettier ^2.8.7 -> ^3.4.0 - npm + pnpm overrides for serialize-javascript ^7.0.5, tar ^7.5.11, axios ^1.15.2 to break vulnerable transitive chains - delete package-lock.json and bun.lockb; canonical package manager is pnpm per website/Taskfile.yml (`pnpm install`). Dropping the parallel lockfiles also stops Dependabot scanning two manifests against the same package.json
…izard, dnd-test) - docs/: astro ^6.0.0 -> ^6.1.10 (Astro XSS via define:vars, GHSA-j687-52p2-xcff and server island param replay GHSA-xr5h-phrj-8vxv); add overrides for fast-uri ^3.1.2, fast-xml-builder ^1.1.7, yaml ^2.8.3 to clear transitive advisories via @astrojs/check -> yaml-language-server chain. - scripts/sponsors/: refresh lockfile so sponsorkit picks up patched defu. - v3/internal/setupwizard/frontend/: vite ^5.4.10 -> ^7.0.0. - v3/test/dnd-npm-runtime/frontend/: vite ^5.0.0 -> ^7.0.0.
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughRepo-wide modernization: Go toolchain pins and numerous indirect dependency bumps; frontend/tooling upgrades to Vite 7 and TS 5; template framework major upgrades; package override pins added; small runtime/context-menu refinements and localized MDX fixes. ChangesDependency and toolchain modernization
🎯 4 (Complex) | ⏱️ ~45 minutes
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (5)
docs/package.json (1)
31-34: ⚡ Quick winUse exact override versions instead of caret ranges.
Lines 32-34 use
^ranges, which allow version drift after lockfile refreshes. Pin exact versions for deterministic vulnerability remediation.Proposed change
"overrides": { - "fast-uri": "^3.1.2", - "fast-xml-builder": "^1.1.7", - "yaml": "^2.8.3" + "fast-uri": "3.1.2", + "fast-xml-builder": "1.1.7", + "yaml": "2.8.3" }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/package.json` around lines 31 - 34, The overrides object currently pins dependencies using caret ranges ("fast-uri": "^3.1.2", "fast-xml-builder": "^1.1.7", "yaml": "^2.8.3"); change each override to an exact version (remove the leading ^ so values become "3.1.2", "1.1.7", "2.8.3") to ensure determinism. Update the overrides entries for the keys fast-uri, fast-xml-builder, and yaml in package.json accordingly and run your install/lockfile regeneration to capture the pinned versions.website/package.json (1)
47-51: ⚡ Quick winUse exact versions in override entries for deterministic security resolutions.
Both the root-level
overridesblock (lines 47-51) and thepnpm.overridesblock (lines 53-57) use caret ranges (^) forserialize-javascript,tar, andaxios. For supply-chain remediation consistency, use exact versions without the^prefix.Proposed change
"overrides": { - "serialize-javascript": "^7.0.5", - "tar": "^7.5.11", - "axios": "^1.15.2" + "serialize-javascript": "7.0.5", + "tar": "7.5.11", + "axios": "1.15.2" }, "pnpm": { "overrides": { - "serialize-javascript": "^7.0.5", - "tar": "^7.5.11", - "axios": "^1.15.2" + "serialize-javascript": "7.0.5", + "tar": "7.5.11", + "axios": "1.15.2" } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@website/package.json` around lines 47 - 51, The overrides entries use caret ranges which prevents deterministic resolutions; update the override keys in the package.json "overrides" block and the "pnpm.overrides" block to pin exact versions by removing the caret prefix for "serialize-javascript", "tar", and "axios" (e.g., change "^7.0.5" to "7.0.5") so the resolver uses the fixed versions; modify the values for the same keys in both overrides sections to the exact version strings to ensure consistent supply-chain remediation.v2/examples/customlayout/myfrontend/package.json (1)
11-11: Vite 7.0.0 is confirmed stable and production-ready. However, Vite 8.0.12 was released on May 11, 2026 and is the latest stable version. The current dependency^7.0.0pins to the 7.x release line. Consider updating to^8.0.0to benefit from the latest features and patches.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@v2/examples/customlayout/myfrontend/package.json` at line 11, The package.json currently pins the Vite dependency as "vite": "^7.0.0" which keeps the project on the 7.x line; update that entry to use the current stable major (e.g., "^8.0.0" or the exact latest "^8.0.12") to receive the newest features and fixes, then run npm/yarn install and verify the app builds and dev server (vite) still works; look for the "vite" dependency string in package.json to change.v2/pkg/templates/templates/lit-ts/frontend/package.json (1)
23-24: ⚡ Quick winAdd an
engines.nodefloor for Vite 7 templates.With
viteupgraded to^7.0.0, this and other scaffold manifests should declare a Node minimum to avoid opaque install/build failures. Vite 7 requires Node.js 20.19+ or 22.12+.Suggested manifest change
{ "name": "frontend", "private": true, "version": "0.0.0", "type": "module", + "engines": { + "node": ">=20.19.0 || >=22.12.0" + }, "main": "dist/my-element.es.js", ... }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@v2/pkg/templates/templates/lit-ts/frontend/package.json` around lines 23 - 24, Add an engines.node field to the template's package.json to declare a minimum Node version required for Vite 7 (e.g., ">=20.19.0" or ">=22.12.0"); update the manifest near the existing dependencies (references: the package.json file, the "vite" dependency) so installers see the Node floor and avoid opaque install/build failures when using Vite 7. Ensure the new engines key is a top-level field in package.json alongside name/version and uses a standards-compliant semver range (engines.node).v2/pkg/templates/templates/vanilla-ts/frontend/package.json (1)
11-12: Review the impact of Node.js 20+ requirement and browser target changes from Vite 7 and TypeScript 5 upgrades.The major version jumps are valid concerns. Verification confirms breaking changes exist but the versions are compatible with vanilla TypeScript templates. Key impacts:
- Node.js version: Vite 7 requires Node.js 20.19+ or 22.12+ (drops Node 18 support). Ensure this requirement is documented and that CI/local development environments meet it.
- Browser target defaults: Vite 7 changes
build.targetdefault from'modules'(Chrome 87+, Safari 14+) to'baseline-widely-available'(Chrome 107+, Safari 16+). Verify this assumption aligns with project requirements; older browser support needs explicitbuild.targetconfig.- TypeScript 5 stricter checks: New defaults like
--forceConsistentCasingInFileNames: trueand stricter type validation (nullish checks, enum rules). Test that the template code and any generated code pass strict type checks without errors.These are mostly environmental and default-behavior changes, not code incompatibilities. Vanilla TS templates avoid the deprecated features (Sass API, splitVendorChunk, SSR hooks). Recommend testing the template scaffolding with Node 20+ to ensure build and dev server work as expected, and review tsconfig.json defaults for TypeScript 5 compatibility.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@v2/pkg/templates/templates/vanilla-ts/frontend/package.json` around lines 11 - 12, Update documentation and configs to reflect Vite 7 and TypeScript 5 impacts: note Node.js 20.19+/22.12+ requirement (add to README and CI engines), ensure package.json entries "vite" and "typescript" are deliberate, and add an explicit Vite build.target override (e.g., set build.target in vite.config.ts) if older browser support is required; run the template scaffold build/dev server under Node 20+ and fix any TypeScript 5 issues by adjusting tsconfig.json (e.g., check forceConsistentCasingInFileNames, strict/nullish checks) and the template source until tsc passes in CI.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@v2/internal/frontend/runtime/runtime_prod_desktop.js`:
- Line 1: The switch in function j uses a default: branch that declares
block-scoped variables (e.g., let o and let s) which violates
noSwitchDeclarations; wrap the entire default: body in braces (default: { ... })
in the source runtime module where function j is defined, then
rebuild/regenerate the bundled file (runtime_prod_desktop) so the emitted bundle
no longer has let/const declarations directly under default.
In `@v2/pkg/templates/templates/vanilla/frontend/package.json`:
- Line 11: The template currently pins Vite to "^7.0.0" (package.json) but
doesn't reflect Vite 7 breaking changes: update the project docs and CI
configuration to require Node.js 20.19+ (or 22.12+), adjust the Vite config
(vite.config.*) to explicitly set build.target to the desired older browser
baseline if you must support pre-Vite7 browsers (e.g., set build.target instead
of relying on defaults), and review any Sass usage to ensure it uses the modern
compiler API (replace legacy Sass options if present); update example setup and
README to call out these requirements so new projects and CI enforce the correct
Node and build target.
In `@v2/pkg/templates/templates/vue-ts/frontend/package.json`:
- Around line 12-19: The template's devDependencies allow an incompatible
combination (vue-tsc "^2.1.0" vs typescript "^5.6.3"); update the dependency
version for "vue-tsc" to at least ^2.2.0 to pick up the fix for the tsc
entrypoint change, or alternatively constrain "typescript" to a safe range
(e.g., ^5.0.0 <5.7) so the resolver cannot install TS >=5.7; modify the
package.json devDependencies entries for "vue-tsc" and/or "typescript"
accordingly to ensure compatible ranges.
In `@v3/examples/dev/frontend/package.json`:
- Around line 12-14: The Counter.svelte component still declares reactive state
with the old pattern; update the component by replacing the plain JS variable
declaration `let count = 0` with Svelte 5 reactive state using `let count =
$state(0)` and keep the existing increment handler (e.g., `increment`) as-is so
`count += 1` updates correctly; ensure any other uses of `count` in the template
remain unchanged and import or enable the $state runtime if required by your
project setup.
In `@webview2/scripts/go.mod`:
- Line 3: The go.mod currently declares an invalid Go version ("go 1.25.0");
update the module's go directive to a valid stable release (e.g., change the
"go" directive to "go 1.26.3" or another project-compatible stable version) so
the build toolchain recognizes the version; modify the go directive in go.mod
(the line starting with "go") and run a quick `go env`/`go version` locally to
confirm compatibility.
---
Nitpick comments:
In `@docs/package.json`:
- Around line 31-34: The overrides object currently pins dependencies using
caret ranges ("fast-uri": "^3.1.2", "fast-xml-builder": "^1.1.7", "yaml":
"^2.8.3"); change each override to an exact version (remove the leading ^ so
values become "3.1.2", "1.1.7", "2.8.3") to ensure determinism. Update the
overrides entries for the keys fast-uri, fast-xml-builder, and yaml in
package.json accordingly and run your install/lockfile regeneration to capture
the pinned versions.
In `@v2/examples/customlayout/myfrontend/package.json`:
- Line 11: The package.json currently pins the Vite dependency as "vite":
"^7.0.0" which keeps the project on the 7.x line; update that entry to use the
current stable major (e.g., "^8.0.0" or the exact latest "^8.0.12") to receive
the newest features and fixes, then run npm/yarn install and verify the app
builds and dev server (vite) still works; look for the "vite" dependency string
in package.json to change.
In `@v2/pkg/templates/templates/lit-ts/frontend/package.json`:
- Around line 23-24: Add an engines.node field to the template's package.json to
declare a minimum Node version required for Vite 7 (e.g., ">=20.19.0" or
">=22.12.0"); update the manifest near the existing dependencies (references:
the package.json file, the "vite" dependency) so installers see the Node floor
and avoid opaque install/build failures when using Vite 7. Ensure the new
engines key is a top-level field in package.json alongside name/version and uses
a standards-compliant semver range (engines.node).
In `@v2/pkg/templates/templates/vanilla-ts/frontend/package.json`:
- Around line 11-12: Update documentation and configs to reflect Vite 7 and
TypeScript 5 impacts: note Node.js 20.19+/22.12+ requirement (add to README and
CI engines), ensure package.json entries "vite" and "typescript" are deliberate,
and add an explicit Vite build.target override (e.g., set build.target in
vite.config.ts) if older browser support is required; run the template scaffold
build/dev server under Node 20+ and fix any TypeScript 5 issues by adjusting
tsconfig.json (e.g., check forceConsistentCasingInFileNames, strict/nullish
checks) and the template source until tsc passes in CI.
In `@website/package.json`:
- Around line 47-51: The overrides entries use caret ranges which prevents
deterministic resolutions; update the override keys in the package.json
"overrides" block and the "pnpm.overrides" block to pin exact versions by
removing the caret prefix for "serialize-javascript", "tar", and "axios" (e.g.,
change "^7.0.5" to "7.0.5") so the resolver uses the fixed versions; modify the
values for the same keys in both overrides sections to the exact version strings
to ensure consistent supply-chain remediation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b37a9de6-1004-46e0-be36-7c2a7fde2446
⛔ Files ignored due to path filters (34)
docs/package-lock.jsonis excluded by!**/package-lock.jsonscripts/sponsors/package-lock.jsonis excluded by!**/package-lock.jsonv2/examples/customlayout/go.sumis excluded by!**/*.sumv2/examples/dragdrop-test/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv2/examples/dragdrop-test/go.sumis excluded by!**/*.sumv2/go.sumis excluded by!**/*.sumv2/internal/frontend/runtime/dev/package-lock.jsonis excluded by!**/package-lock.jsonv2/internal/frontend/runtime/package-lock.jsonis excluded by!**/package-lock.jsonv2/internal/staticanalysis/test/standard/go.sumis excluded by!**/*.sumv3/examples/android/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/examples/android/go.sumis excluded by!**/*.sumv3/examples/custom-protocol-example/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/examples/dev/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/examples/dev/go.sumis excluded by!**/*.sumv3/examples/dock/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/examples/file-association/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/examples/file-association/go.sumis excluded by!**/*.sumv3/examples/gin-example/go.sumis excluded by!**/*.sumv3/examples/gin-routing/go.sumis excluded by!**/*.sumv3/examples/gin-service/go.sumis excluded by!**/*.sumv3/examples/ios/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/examples/ios/go.sumis excluded by!**/*.sumv3/examples/notifications/go.sumis excluded by!**/*.sumv3/examples/print/go.sumis excluded by!**/*.sumv3/examples/server/go.sumis excluded by!**/*.sumv3/go.sumis excluded by!**/*.sumv3/internal/runtime/desktop/@wailsio/runtime/package-lock.jsonis excluded by!**/package-lock.jsonv3/internal/setupwizard/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/test/dnd-npm-runtime/frontend/package-lock.jsonis excluded by!**/package-lock.jsonv3/tests/window-visibility-test/go.sumis excluded by!**/*.sumwebsite/bun.lockbis excluded by!**/bun.lockbwebsite/package-lock.jsonis excluded by!**/package-lock.jsonwebsite/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlwebview2/scripts/go.sumis excluded by!**/*.sum
📒 Files selected for processing (51)
docs/package.jsonv2/examples/customlayout/go.modv2/examples/customlayout/myfrontend/package.jsonv2/examples/dragdrop-test/frontend/package.jsonv2/examples/dragdrop-test/go.modv2/examples/panic-recovery-test/frontend/package.jsonv2/go.modv2/internal/frontend/runtime/dev/package.jsonv2/internal/frontend/runtime/ipc_websocket.jsv2/internal/frontend/runtime/package.jsonv2/internal/frontend/runtime/runtime_debug_desktop.jsv2/internal/frontend/runtime/runtime_prod_desktop.jsv2/internal/staticanalysis/test/standard/go.modv2/pkg/templates/templates/lit-ts/frontend/package.jsonv2/pkg/templates/templates/lit/frontend/package.jsonv2/pkg/templates/templates/preact-ts/frontend/package.jsonv2/pkg/templates/templates/preact/frontend/package.jsonv2/pkg/templates/templates/react-ts/frontend/package.jsonv2/pkg/templates/templates/react/frontend/package.jsonv2/pkg/templates/templates/svelte-ts/frontend/package.jsonv2/pkg/templates/templates/svelte/frontend/package.jsonv2/pkg/templates/templates/vanilla-ts/frontend/package.jsonv2/pkg/templates/templates/vanilla/frontend/package.jsonv2/pkg/templates/templates/vue-ts/frontend/package.jsonv2/pkg/templates/templates/vue/frontend/package.jsonv3/examples/android/frontend/package.jsonv3/examples/android/go.modv3/examples/badge-custom/frontend/package.jsonv3/examples/badge/frontend/package.jsonv3/examples/custom-protocol-example/frontend/package.jsonv3/examples/dev/frontend/package.jsonv3/examples/dev/go.modv3/examples/dock/frontend/package.jsonv3/examples/file-association/frontend/package.jsonv3/examples/file-association/go.modv3/examples/gin-example/go.modv3/examples/gin-routing/go.modv3/examples/gin-service/go.modv3/examples/ios/frontend/package.jsonv3/examples/ios/go.modv3/examples/notifications/frontend/package.jsonv3/examples/notifications/go.modv3/examples/print/go.modv3/examples/server/go.modv3/go.modv3/internal/runtime/desktop/@wailsio/runtime/package.jsonv3/internal/setupwizard/frontend/package.jsonv3/test/dnd-npm-runtime/frontend/package.jsonv3/tests/window-visibility-test/go.modwebsite/package.jsonwebview2/scripts/go.mod
Comment on lines
+12
to
+19
| "vue": "^3.5.0" | ||
| }, | ||
| "devDependencies": { | ||
| "@vitejs/plugin-vue": "^3.0.3", | ||
| "typescript": "^4.6.4", | ||
| "vite": "^3.0.7", | ||
| "vue-tsc": "^1.8.27", | ||
| "@babel/types": "^7.18.10" | ||
| "@vitejs/plugin-vue": "^6.0.0", | ||
| "typescript": "^5.6.3", | ||
| "vite": "^7.0.0", | ||
| "vue-tsc": "^2.1.0", | ||
| "@babel/types": "^7.26.0" |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Is @vitejs/plugin-vue version 6.0.0 compatible with Vue 3.5.0 and Vite 7.0.0?
💡 Result:
Yes—@vitejs/plugin-vue v6.0.0 is compatible with Vue 3.5.0 and Vite 7.0.0, based on the plugin’s published peer-dependency ranges. 1) Compatibility with Vite 7.0.0 The npm page for @vitejs/plugin-vue states its peer dependency for vite includes ^7.0.0 (along with ^5.0.0 and ^6.0.0 and ^8.0.0), which covers Vite 7.0.0. [1] 2) Compatibility with Vue 3.5.0 The same npm page lists the plugin’s peer dependency for vue as ^3.2.25, which includes Vue 3.5.0 (any 3.x version >= 3.2.25 satisfies ^3.2.25). [1] Caveat: peer dependency ranges do not guarantee zero-runtime issues for every combination, but from an install/declared compatibility standpoint, v6.0.0 covers both Vue 3.5.0 and Vite 7.0.0. [1]
Citations:
🌐 Web query:
Is vue-tsc 2.1.0 compatible with TypeScript 5.6.3 and Vue 3.5.0?
💡 Result:
No, vue-tsc 2.1.0 is not compatible with TypeScript 5.6.3. Users reported crashes and errors when using vue-tsc 2.1.x (including 2.1.10) with TypeScript 5.7.x, due to changes in TypeScript's tsc entry point (from tsc.js to _tsc.js), which vue-tsc tried to patch but failed, causing "Search string not found" errors [1]. A fix was merged later in v2.2.0 for TS 5.7 support [2][3]. Since TS 5.6.3 is a prior minor version in the same major (5.x), and no sources confirm explicit support for 5.6 in 2.1.0, while issues arose with nearby 5.7, compatibility is unlikely without issues. Users had to downgrade to vue-tsc 2.0.29 + TS 5.6.2 [1].
Citations:
- 1: vue-tsc doesn't work with typescript 5.7.2 vuejs/language-tools#5018
- 2: https://github.com/vuejs/language-tools/releases/tag/v2.2.0
- 3: https://github.com/vuejs/language-tools/blob/master/changelogs/CHANGELOG-v2.md
Update vue-tsc to v2.2.0 or later; incompatible with TypeScript 5.6.3+.
@vitejs/plugin-vue v6.0.0 is compatible with Vue 3.5.0 and Vite 7.0.0 (✓), but vue-tsc 2.1.0 has a documented incompatibility with TypeScript 5.6.3 and higher. TypeScript 5.7+ changed the internal tsc entry point from tsc.js to _tsc.js, breaking vue-tsc 2.1.x's internal patches and causing "Search string not found" errors. A fix was merged in vue-tsc 2.2.0. Since the template specifies ^2.1.0 and ^5.6.3, the ranges can resolve to incompatible combinations. Upgrade to vue-tsc@^2.2.0 or constrain TypeScript to ^5.0.0 <5.7.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@v2/pkg/templates/templates/vue-ts/frontend/package.json` around lines 12 -
19, The template's devDependencies allow an incompatible combination (vue-tsc
"^2.1.0" vs typescript "^5.6.3"); update the dependency version for "vue-tsc" to
at least ^2.2.0 to pick up the fix for the tsc entrypoint change, or
alternatively constrain "typescript" to a safe range (e.g., ^5.0.0 <5.7) so the
resolver cannot install TS >=5.7; modify the package.json devDependencies
entries for "vue-tsc" and/or "typescript" accordingly to ensure compatible
ranges.
Member
Author
There was a problem hiding this comment.
Confirming: the web-search result in your own comment says "@vitejs/plugin-vue v6.0.0 is compatible with Vue 3.5.0 and Vite 7.0.0" — its peer-deps list vite ^5||^6||^7||^8. Combination is valid.
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
vue-tsc 2.1.0 TypeScript 5.6 5.7 compatibility latest version 2025
💡 Result:
-
TypeScript 5.6:
vue-tscv2.x supports TS ≥5.0 (so TS 5.6 is generally OK), and TS 5.6 is a real release line. [5] -
TypeScript 5.7:
vue-tscv2.1.x (e.g., 2.1.10) has a known failure with TS 5.7.x (Search string not found: "/supportedTSExtensions..."). This was reproducible already on TS 5.7 RC and later with TS 5.7.2. [1][2]- Common workaround reported: downgrade to
vue-tsc@2.0.29+typescript@5.6.2. [2]
- Common workaround reported: downgrade to
-
Latest
vue-tscversion (as of May 4, 2026): 3.2.8. [3][4]
Practical takeaway: if you need TS 5.7, don’t stay on vue-tsc@2.1.0/2.1.x—upgrade to the latest 3.x (currently 3.2.8). [1][3][4]
Sources: [1] GitHub issue (TS 5.7 RC triggers the error), [2] incident report showing vue-tsc@2.1.10 + typescript@5.7.2 failing and downgrade fix, [3] Snyk package page showing latest vue-tsc 3.2.8 and publish date, [4] Arch Linux commit referencing tag v3.2.8, [5] TypeScript 5.6 release notes.
@leaanthony, you're absolutely right about @vitejs/plugin-vue — my own web search confirmed that concern was not an issue, and I should not have framed it as critical.
However, the actionable concern in my comment is actually about vue-tsc, not plugin-vue. They're two separate issues:
- The
vue-tscv2.1.x line has a known breakage with TypeScript 5.7+, triggered by thetsc.js→_tsc.jsinternal entry-point rename, causing "Search string not found" errors. - The latest
vue-tscas of May 2026 is 3.2.8.
The risk in the template is that "typescript": "^5.6.3" allows npm/pnpm to install TypeScript 5.7, 5.8, … when a user runs wails init and npm install. If that happens alongside "vue-tsc": "^2.1.0" (which stays on the 2.x track), the build step (vue-tsc --noEmit && vite build) will fail for the end user.
That said, since you own this codebase and know the intended usage, I'll defer to your judgment. If you'd like, I can log this as a follow-up issue to bump vue-tsc to ^3.2.0 (the current stable series) when you're ready.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR performs a broad dependency refresh across Wails v2/v3 Go modules and multiple Node-based subprojects (runtimes, templates, examples, docs, website) to eliminate open Dependabot security alerts.
Changes:
- Bumped vulnerable Go dependencies across core modules, examples, tests, and scripts (notably
golang.org/x/*,go-git/*,sha1cd, etc.). - Updated JavaScript tooling and framework deps (notably Vite →
^7, Vitest upgrades, and addedoverridesto break vulnerable transitive chains). - Regenerated/updated several lockfiles and built JS artifacts to reflect the upgraded toolchains.
Reviewed changes
Copilot reviewed 48 out of 85 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| webview2/scripts/go.mod | Updates Go version and golang.org/x/net for the webview2 updater scripts |
| webview2/scripts/go.sum | Refreshes sums after golang.org/x/net bump |
| website/package.json | Updates Crowdin CLI/client + Prettier; adds npm/pnpm overrides for vulnerable transitives |
| v3/tests/window-visibility-test/go.mod | Updates Go version and several indirect Go deps used by the test module |
| v3/tests/window-visibility-test/go.sum | Refreshes sums for updated indirect dependencies |
| v3/test/dnd-npm-runtime/frontend/package.json | Bumps Vite to ^7 for the test frontend |
| v3/internal/setupwizard/frontend/package.json | Bumps Vite to ^7 for the setup wizard frontend |
| v3/internal/runtime/desktop/@wailsio/runtime/package.json | Updates runtime dev deps (happy-dom/vite/vitest/etc) and adds overrides |
| v3/go.mod | Bumps core Go dependencies for v3 (go-git, x/*, etc) |
| v3/go.sum | Refreshes sums for updated v3 module dependencies |
| v3/examples/server/go.mod | Updates Go version and indirect dependency versions for the server example |
| v3/examples/server/go.sum | Refreshes sums for the server example’s updated deps |
| v3/examples/print/go.mod | Updates Go version and indirect dependency versions for the print example |
| v3/examples/print/go.sum | Refreshes sums for the print example’s updated deps |
| v3/examples/notifications/go.mod | Updates Go version and indirect dependency versions for the notifications example |
| v3/examples/notifications/go.sum | Refreshes sums for the notifications example’s updated deps |
| v3/examples/notifications/frontend/package.json | Bumps TypeScript and Vite for notifications example frontend |
| v3/examples/ios/go.mod | Updates Go version and indirect dependency versions for the iOS example |
| v3/examples/ios/go.sum | Refreshes sums for the iOS example’s updated deps |
| v3/examples/ios/frontend/package.json | Bumps Vite for iOS example frontend |
| v3/examples/gin-service/go.mod | Updates Go version and indirect dependency versions for gin-service example |
| v3/examples/gin-service/go.sum | Refreshes sums for gin-service example’s updated deps |
| v3/examples/gin-routing/go.mod | Updates Go version and indirect dependency versions for gin-routing example |
| v3/examples/gin-routing/go.sum | Refreshes sums for gin-routing example’s updated deps |
| v3/examples/gin-example/go.mod | Updates Go version and indirect dependency versions for gin example |
| v3/examples/gin-example/go.sum | Refreshes sums for gin example’s updated deps |
| v3/examples/file-association/go.mod | Updates Go version and indirect dependency versions for file-association example |
| v3/examples/file-association/go.sum | Refreshes sums for file-association example’s updated deps |
| v3/examples/file-association/frontend/package.json | Bumps Vite for file-association example frontend |
| v3/examples/dock/frontend/package.json | Bumps TypeScript and Vite for dock example frontend |
| v3/examples/dev/go.mod | Updates Go version and indirect dependency versions for dev example |
| v3/examples/dev/go.sum | Refreshes sums for dev example’s updated deps |
| v3/examples/dev/frontend/package.json | Updates Svelte + plugin + Vite for dev example frontend |
| v3/examples/custom-protocol-example/frontend/package.json | Bumps Vite for custom-protocol example frontend |
| v3/examples/badge/frontend/package.json | Bumps TypeScript and Vite for badge example frontend |
| v3/examples/badge-custom/frontend/package.json | Bumps TypeScript and Vite for badge-custom example frontend |
| v3/examples/android/go.mod | Updates Go version and indirect dependency versions for Android example |
| v3/examples/android/go.sum | Refreshes sums for Android example’s updated deps |
| v3/examples/android/frontend/package.json | Bumps Vite for Android example frontend |
| v2/pkg/templates/templates/vue/frontend/package.json | Updates Vue template scaffold deps (Vue/Vite/plugin-vue) |
| v2/pkg/templates/templates/vue-ts/frontend/package.json | Updates Vue+TS template scaffold deps (Vue/Vite/plugin-vue/TS/vue-tsc/etc) |
| v2/pkg/templates/templates/vanilla/frontend/package.json | Updates vanilla template scaffold to Vite ^7 |
| v2/pkg/templates/templates/vanilla-ts/frontend/package.json | Updates vanilla+TS template scaffold to TS ^5.6 + Vite ^7 |
| v2/pkg/templates/templates/svelte/frontend/package.json | Updates Svelte template scaffold to Svelte 5 + plugin + Vite ^7 |
| v2/pkg/templates/templates/svelte-ts/frontend/package.json | Updates Svelte+TS scaffold deps (tsconfig/check/tslib/TS + Vite ^7) |
| v2/pkg/templates/templates/react/frontend/package.json | Updates React template scaffold to React 19 + Vite plugin-react + Vite ^7 |
| v2/pkg/templates/templates/react-ts/frontend/package.json | Updates React+TS template scaffold to React 19 + TS ^5.6 + Vite ^7 |
| v2/pkg/templates/templates/preact/frontend/package.json | Updates Preact template scaffold deps (preact/preset-vite + Vite ^7) |
| v2/pkg/templates/templates/preact-ts/frontend/package.json | Updates Preact+TS scaffold deps (TS ^5.6 + Vite ^7) |
| v2/pkg/templates/templates/lit/frontend/package.json | Updates Lit template scaffold to Lit 3 + Vite ^7 |
| v2/pkg/templates/templates/lit-ts/frontend/package.json | Updates Lit+TS scaffold deps (TS ^5.6 + Vite ^7) |
| v2/internal/staticanalysis/test/standard/go.mod | Updates Go version and indirect Go deps for staticanalysis test fixture |
| v2/internal/staticanalysis/test/standard/go.sum | Refreshes sums for updated fixture dependencies |
| v2/internal/frontend/runtime/package.json | Updates runtime build/test toolchain deps (esbuild/happy-dom/svelte/vitest) |
| v2/internal/frontend/runtime/dev/package.json | Updates esbuild for runtime dev bundle build |
| v2/internal/frontend/runtime/runtime_prod_desktop.js | Updates generated/minified runtime artifact after toolchain bumps |
| v2/go.mod | Updates v2 module dependencies (go-git, testify, x/*, etc) |
| v2/examples/panic-recovery-test/frontend/package.json | Bumps Vite for this example frontend |
| v2/examples/dragdrop-test/go.mod | Updates Go version, updates indirect deps, removes stale local replace |
| v2/examples/dragdrop-test/go.sum | Refreshes sums for updated example dependencies |
| v2/examples/dragdrop-test/frontend/package.json | Bumps Vite for this example frontend |
| v2/examples/customlayout/myfrontend/package.json | Bumps Vite for this example frontend |
| v2/examples/customlayout/go.mod | Updates Go version and indirect deps for customlayout example module |
| v2/examples/customlayout/go.sum | Refreshes sums for updated customlayout example dependencies |
| docs/package.json | Bumps Astro and adds overrides to address vulnerable transitives |
Files not reviewed (12)
- docs/package-lock.json: Language not supported
- scripts/sponsors/package-lock.json: Language not supported
- v2/examples/dragdrop-test/frontend/package-lock.json: Language not supported
- v2/internal/frontend/runtime/runtime_prod_desktop.js: Language not supported
- v3/examples/android/frontend/package-lock.json: Language not supported
- v3/examples/custom-protocol-example/frontend/package-lock.json: Language not supported
- v3/examples/dev/frontend/package-lock.json: Language not supported
- v3/examples/dock/frontend/package-lock.json: Language not supported
- v3/examples/file-association/frontend/package-lock.json: Language not supported
- v3/examples/ios/frontend/package-lock.json: Language not supported
- v3/internal/setupwizard/frontend/package-lock.json: Language not supported
- v3/test/dnd-npm-runtime/frontend/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Per CodeRabbit + Cloudflare Pages preview build:
- v2/internal/frontend/runtime/desktop/contextmenu.js: wrap `default:` clause
body in a block so the `let` declarations don't trip the
`noSwitchDeclarations` lint rule. Regenerated runtime_{debug,prod}_desktop.js.
- docs/src/content/docs/{de,fr,ja,ko,pt,ru,zh-tw}/quick-start/installation.mdx:
the translations all lost a chunk between the Windows TabItem and the
`#### Go version too old` heading. Close the open `<Tabs>` + `<Steps>`
blocks and reinsert a localized `## Troubleshooting` h2 so the page
parses under stricter MDX. The macOS/Linux npm install tabs and the
`wails3 command not found` section are still missing in those locales -
follow-up for the translation team.
- docs/src/content/docs/zh-tw/index.mdx: escape `<0.5` -> `<0.5` so MDX
doesn't interpret it as a JSX tag (the other translations already had it
escaped).
… passes The Run JS Tests CI uses `npm ci` (strict peer-dep resolution). With typedoc bumped to ^0.28.0, the older plugin pins broke: - typedoc-plugin-mdn-links ^4.0.13 -> ^5.1.1 (typedoc 0.27.x||0.28.x) - typedoc-plugin-missing-exports ^3.1.0 -> ^4.1.3 (typedoc ^0.28.1) Regenerated package-lock.json. `npm ci && npm audit` now clean without needing --legacy-peer-deps.
Member
Author
|
Superseded by a freshly-rebased PR — closing this one. Master diverged hard after Dependabot's batch PR #5443 merged (which fixed 337 of the 449 alerts here), and rebasing this 6-commit branch produced too many conflicts on package.json files that #5443 had also touched (different target versions for vite, happy-dom, svelte etc). Restarting from current master is cleaner. New PR coming up. |
auto-merge was automatically disabled
May 15, 2026 05:25
Pull request was closed
5 tasks
leaanthony
added a commit
that referenced
this pull request
May 15, 2026
* chore(deps): bump Go deps for v2, v3, and staticanalysis test module Dependabot's npm-only batch (#5443) didn't touch Go modules. This bumps: - v2/go.mod: go-git ^5.13 -> ^5.19, x/crypto ^0.33 -> ^0.51, x/net ^0.35 -> ^0.54, x/image ^0.12 -> ^0.40, cloudflare/circl ^1.3 -> ^1.6 (closes ~16 alerts on v2/go.mod) - v3/go.mod: go-git, x/image transitive bumps (closes ~8 alerts) - v2/internal/staticanalysis/test/standard/go.mod: x/crypto, x/net, x/image * chore(deps): bump v2 template package.json deps Templates are scaffolds (no lockfile - Dependabot batch only patches lock- files, so these were left behind). Bumped: - vite ^3.0.7 -> ^7.0.0 across 10 templates (clears the path-traversal + server.fs.deny advisory chain, ~80 alerts) - react ^18 -> ^19 (+ @types, @vitejs/plugin-react ^2 -> ^5) - vue ^3.2 -> ^3.5 (+ plugin ^3 -> ^6, vue-tsc ^1 -> ^2, @babel/types) - preact-preset-vite + preact transitive bumps - lit ^2 -> ^3 - typescript ^4 -> ^5.6 across all -ts templates svelte / svelte-ts templates were already brought current by #5443; this just adds the typescript bump there. * fix(v2 runtime): wrap default switch in block + adapt dev build to svelte 5 - desktop/contextmenu.js: wrap the `default:` clause body in a block so `let` declarations stay scoped, satisfying Biome's noSwitchDeclarations (flagged by CodeRabbit on PR #5429). - dev/build.js: switch to `compilerOptions: {css: "injected"}` so esbuild- svelte under svelte 5 inlines stylesheet output into the bundle. Without this, svelte 5 emits a sibling `ipc_websocket.css` that `//go:embed ipc_websocket.js` doesn't pick up - leaving the reconnect-overlay unstyled. (Latent break introduced by #5443's svelte 3 -> 5 bump.) - Regenerated ipc_websocket.js, runtime_prod_desktop.js, runtime_debug_desktop.js. * chore(deps): clear remaining stragglers - v3/internal/runtime/desktop/@wailsio/runtime: add overrides for serialize-javascript ^7.0.5 and diff ^8.0.2 to break the transitive vuln chain via promises-aplus-tests -> mocha. Also bump typedoc to ^0.28 with compatible plugin versions (the lockfile under master was out-of-sync: typedoc 0.27 with typedoc-plugin-markdown 4.11 which peer-requires 0.28.x). - scripts/sponsors: refresh lockfile so sponsorkit pulls patched defu. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * ci: retrigger after artifact-retention flake on ubuntu v3 rerun --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sweeps all 449 open Dependabot alerts (3 critical, 91 high, 288 moderate, 67 low) on
masterby bumping vulnerable packages across Go modules, runtime npm packages, template scaffolds, examples, and the docs/website. All audits clean locally (go mod tidy,npm audit,pnpm auditall report 0 findings).Commits (6, organised by area for review)
359824dGo deps —v2/go.mod,v3/go.mod,webview2/scripts/go.mod, plus every flagged go.mod inv2/examples/,v3/examples/,v3/tests/,v2/internal/staticanalysis/test/standard/. Bumpsgolang.org/x/{crypto,net,image},github.com/go-git/go-git/v5,github.com/cloudflare/circlto patched versions. Also removes a stalereplace github.com/wailsapp/wails/v2 => E:/releases/wails/v2fromv2/examples/dragdrop-test/go.modthat pointed at a Windows-only dev path.91c5ce3v2 + v3 runtime npm — clears the 3 critical alerts:^7.6.0→^20.0.0inv2/internal/frontend/runtime/(GHSA-37j7-fg3j-429f VM context escape RCE)^17.1.1→^20.0.0inv3/internal/runtime/desktop/@wailsio/runtime/overridesadded forserialize-javascript ^7.0.5anddiff ^8.0.2to break thepromises-aplus-tests → mocha/sinonvuln chainv2/internal/frontend/runtime/dev/: esbuild bumped, but svelte/esbuild-svelte kept at v3-compat so the embedded reconnect-overlay build output stays single-file (svelte 5 emits CSS separately, which would break//go:embedof the runtime bundle). The remaining svelte SSR-XSS advisories there are non-applicable (client-only runtime, no SSR, nocontenteditable bind:innerText) and I'll dismiss them asnot_usedonce this lands.2c398dav2 templates — bumpsvite ^3.0.7 → ^7.0.0across all 12v2/pkg/templates/templates/*/frontend/package.json. Framework bumps for scaffolds: react^18 → ^19, vue^3.2 → ^3.5(+ plugin/tsc), svelte^3 → ^5(+ plugin-svelte^1 → ^6, dropped now-unused svelte-preprocess), lit^2 → ^3, preact-preset bumped, typescript^4 → ^5.6everywhere. These templates have no lockfile —wails initregenerates one in user projects on first build.4a450d8v2 + v3 example frontends —vite → ^7.0.0across all 12 example frontends. Lockfiles regenerated. TS-typed examples bumped to typescript^5.6.3.v3/examples/devalso bumped to svelte 5 + plugin-svelte 6.a8ed61ewebsite —@crowdin/cli ^3 → ^4.14.2(clears the tar chain),@crowdin/crowdin-api-client → ^1.55.1,prettier → ^3.4.0. Both npm and pnpmoverridesforserialize-javascript ^7.0.5,tar ^7.5.11,axios ^1.15.2. Droppedpackage-lock.jsonandbun.lockb— the canonical package manager is pnpm perwebsite/Taskfile.yml, and the parallel lockfiles were causing Dependabot to fire two alerts per advisory against one package.json.b428a79remaining frontends —docs/(astro^6 → ^6.1.10+ overrides for fast-uri / fast-xml-builder / yaml),scripts/sponsors/(refresh sponsorkit transitive defu),v3/internal/setupwizard/frontend/(vite^5.4 → ^7),v3/test/dnd-npm-runtime/frontend/(vite^5 → ^7).Notable judgement calls
wails initcopies the package.json into new user projects; bumping to current majors is appropriate. If you'd rather hold templates back at their current majors, those bumps are the 2c398da commit alone — easy to revert.replace E:/releases/wails/v2from dragdrop-test/go.mod (developer leftover from a Windows release branch). Flag if this was intentional.package-lock.jsonandbun.lockbmatches whatpnpm installinTaskfile.ymlactually uses; if external tooling expects an npm lockfile, ping me and I'll restore it.v2/internal/frontend/runtime/(ipc_websocket.js, runtime_*_desktop.js) by the bumped esbuild — small minifier-output diffs.After merge
A handful of svelte SSR-XSS advisories will linger in
v2/internal/frontend/runtime/dev/package-lock.json(GHSA-phwv-c562-gvmhand friends). They're non-applicable here — I'll dismiss them asnot_usedwith a written reason once master is updated.Test plan
go build ./...clean inv2/andv3/npm run buildsucceeds inv2/internal/frontend/runtime/(regenerates the bundles in this PR)npm run check(tsc --noEmit) inv3/internal/runtime/desktop/@wailsio/runtime/pnpm build(docusaurus) inwebsite/npm run build(astro check + build) indocs/wails init -t reactSummary by CodeRabbit
Chores
Bug Fixes
Documentation