Skip to content

deps: remediate admin UI build vulnerabilities - #979

Merged
Liangying.Wei (vicancy) merged 2 commits into
mainfrom
vicancy/fix-admin-ui-dependencies
Aug 17, 2026
Merged

deps: remediate admin UI build vulnerabilities#979
Liangying.Wei (vicancy) merged 2 commits into
mainfrom
vicancy/fix-admin-ui-dependencies

Conversation

@vicancy

Copy link
Copy Markdown
Member

Summary

  • pin patched build-chain versions for PostCSS, webpack-dev-server, serialization, proxying, and related utilities
  • remove 18 of the admin UI lockfile's 24 current Dependabot alerts
  • preserve the existing Vue 2 application while validating cross-major tooling compatibility end to end

Remaining migration work

  • Vue 2 and vue-template-compiler require a Vue 3 migration; the compiler advisory has no patched Vue 2 release
  • Vuetify 2 requires a Vuetify 3 migration
  • ECharts 5 requires an ECharts 6 migration
  • nanoid 3.3.18 is not yet available from the approved npm feed

Validation

  • Yarn frozen-lockfile install
  • Vue CLI lint
  • Vue production build
  • Vue development server smoke test over loopback (HTTP 200)

Pin patched build-chain dependencies while preserving the existing Vue 2 application until its required major migration can be reviewed separately.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 6897cee9-248f-47db-a739-ab3a51b94527
@vicancy
Liangying.Wei (vicancy) enabled auto-merge (squash) August 17, 2026 01:46
@vicancy
Liangying.Wei (vicancy) merged commit 8022d3e into main Aug 17, 2026
14 checks passed
@vicancy
Liangying.Wei (vicancy) deleted the vicancy/fix-admin-ui-dependencies branch August 17, 2026 01:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants