chore(version bump): Swagger-ui-react to 5.32.14 & pick up patched axios - #6763
Conversation
swagger-ui-react 5.32.14 upgrades swagger-client to 3.38, which pulls @swagger-api/apidom-reference 1.12 and with it axios ^1.18 (resolves to 1.20.0), closing 10 open axios advisories in the UI lockfile, most notably GHSA-gcfj-64vw-6mp9 (high), and unblocking dependency-review on #6433. Generated with GLM-5.3
e1ac378 to
9640cf7
Compare
|
/ci-run-all-tests |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9640cf7fd9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| dompurify@3.2.7, dompurify@3.3.1, dompurify@^3.4.13: | ||
| version "3.3.1" |
There was a problem hiding this comment.
On every Yarn 1 install, the root resolutions entry still forces DOMPurify 3.3.1, so this newly added ^3.4.13 request is incorrectly coalesced into a lock entry whose installed version is below the declared minimum. As a result, the /ui API documentation runs Swagger UI 5.32.14 against an unsupported sanitizer version and misses the DOMPurify upgrade bundled with that release; remove or raise the resolution and regenerate the lockfile.
Useful? React with 👍 / 👎.
swagger-ui-react 5.32.14 requires dompurify ^3.4.13, but the root resolutions pin (kept to force monaco-editor's stale 3.2.7 exact pin upward) still forced 3.3.1, coalescing the new requirement below its declared minimum. Raises the pin to 3.4.14 (latest), satisfying both. Addresses the Codex review comment on this PR.
|
/ci-run-all-tests |
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Description
Bumps
swagger-ui-reactfrom 5.32.0 to 5.32.14 since we need to do that anyway and doing so the UI lockfile picks up a patchedaxios(1.15.2 → 1.20.0) through the dependency chain:axiosis not a direct dependency of the UI — it enters transitively viaswagger-client. The currently pinned 1.15.2 sits inside the affected ranges of 10published advisories, notably GHSA-gcfj-64vw-6mp9 (high; affected
>=1.15.2, <1.18.0).The same ranges are also why
dependency-reviewfails on #6433, whose lockfile regencarries axios 1.16.1 into its diff.
Notable transitive updates, all inside the swagger-ui-react subtree: the
@swagger-api/apidom-*family 1.10.2 → 1.12.0,immutable3.8.3 → 4.3.9,react-redux9.2.0 → 9.3.0,form-data4.0.5 → 4.0.6.