security bumps #8752
security bumps #8752
Conversation
There was a problem hiding this comment.
Pull request overview
This PR performs security-related dependency updates across multiple packages, upgrading Express, various TypeScript types, and associated libraries to newer versions.
Changes:
- Updated Express framework from 4.21.2 to 4.22.0
- Upgraded express-prom-bundle from v7 to v8
- Updated client-side libraries including react-router (7.5.2 → 7.13.0), superagent (10.1.1 → 10.3.0), lodash (4.17.21 → 4.17.23), and qs (6.14.0 → 6.14.1)
- Removed body-parser as a direct dependency (now included within Express)
- Reorganized and updated TypeScript type definitions
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| package.json | Updated dependency versions for security patches; removed body-parser dependency; moved @types/lodash to devDependencies; added @types/react-router |
| yarn.lock | Lock file updates reflecting all package version changes and their transitive dependencies |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "express": "4.22.0", | ||
| "express-http-proxy": "^2.1.1", | ||
| "express-prom-bundle": "^7.0.0", | ||
| "express-prom-bundle": "^8.0.0", |
There was a problem hiding this comment.
The express-prom-bundle package has been upgraded from v7 to v8, which now requires @types/express ^5.0.0 as a dependency (see yarn.lock line 9076). However, the project's devDependencies specify @types/express ^4.17.25 (line 283). This creates a type definition conflict where two incompatible versions of Express types coexist in the dependency tree.
While this may not cause runtime issues since express-prom-bundle is only used in app/server.js (a non-TypeScript file), it could cause:
- TypeScript compilation issues if server.js is converted to TypeScript in the future
- IDE type inference problems
- Confusion about which Express types are the canonical ones
Consider either:
- Upgrading @types/express in devDependencies to ^5.0.0 to match express-prom-bundle's requirement, or
- Verifying that @types/express v4 and v5 are compatible for your use case
| "express-prom-bundle": "^8.0.0", | |
| "express-prom-bundle": "^7.0.0", |
fixes #
PR checklist:
QA checklist: