[DragonVibes]

Problem

osv-scanner on pnpm-lock.yaml at main reports high or critical advisories in 7 packages that have a fixed release in the same major version. A dependency update removes them.

Change

• Bump direct dependencies. @modelcontextprotocol/sdk goes from 1.29.0 to 1.32.0 in apps/server, and dompurify from 3.4.16 to 3.4.17 in apps/web. sharp goes from 0.35.4 to 0.35.5 in apps/marketing and scripts.
• Refresh seroval, shell-quote, and proxy-addr inside their parents' existing ranges. This changes the lockfile only.
• Add one override in pnpm-workspace.yaml. @vercel/routing-utils pins path-to-regexp 6.1.0 exactly, even in its latest release, so the override moves it to 6.3.0.

The lockfile changes only these packages and sharp's platform binaries. The vitest snapshot entries also gain peer metadata, because any pnpm update re-reads it. No version changes there.

Scope and approval

Refs #23907, which lists every advisory with its CVE and where T3 Code uses the package. main has since fixed source-map-js and braces.

This is maintenance with no change to product behavior, and every bump is a patch or minor release. It fixes one problem: dependencies with published advisories. The advisories are public, so this uses a normal PR rather than the private security address.

Out of scope: node-forge and http-cache-semantics have no fixed release yet. uuid 7.0.3 under Expo's xcode needs a major bump. Advisories published after this PR opened, in body-parser, undici, and zod, belong in their own PR.

Verification

• osv-scanner: 17 high or critical packages on current main, 10 on this branch. All 10 are in the out-of-scope list above.
• apps/server: tsc --noEmit is clean. vp test run on the Claude adapter, provider, MCP app, MCP OAuth, and HTTP tests passes 296 of 296. A script ran a tool call through createSdkMcpServer from @anthropic-ai/claude-agent-sdk, which is the SDK's only consumer, on MCP SDK 1.32.0.
• apps/web: tsc --noEmit is clean and vp build succeeds. A local browser test rendered a real flowchart and a math diagram through both DOMPurify sanitizers in MermaidDiagram.tsx. The test failed when I made the sanitizer strip text or msup. The test is not in this PR because nothing in the repo currently covers those sanitizers, and that is a separate problem.
• apps/marketing: astro build succeeds and writes .webp images through sharp 0.35.5. scripts and alchemy's Cloudflare runtime both load the same single sharp 0.35.5.
• Both vercel.ts configs give identical getTransformedRoutes output with path-to-regexp 6.1.0 and 6.3.0.

Not checked: desktop and mobile builds, and a real alchemy or Vercel deploy.

Done with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This is a focused dependency and lockfile update with no product-default or application-logic changes, but it directly remediates high and critical security advisories across server, web, routing, and image-processing paths. The security-sensitive purpose warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: d73fd12
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: a957154b-d300-4984-878c-e5180fa294cb

Commits

Reviewing files that changed from the base of the PR and between 7494b70 and 6c4223a.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 4

• apps/server/package.json
• apps/web/package.json
• pnpm-workspace.yaml
• scripts/package.json

Files skipped from review as they are similar to previous changes: 1

• scripts/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The pull request updates dependencies in the marketing, server, web, and scripts packages. It also adds a workspace override for path-to-regexp used by @vercel/routing-utils.

Changes: Dependency updates

Layer / File(s)	Summary
Dependency versions and resolution apps/marketing/package.json, apps/server/package.json, apps/web/package.json, scripts/package.json, pnpm-workspace.yaml	Updates sharp to 0.35.5 in marketing and scripts, @modelcontextprotocol/sdk to 1.32.0, and dompurify to ^3.4.17. Adds an override that resolves path-to-regexp under @vercel/routing-utils to 6.3.0.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related issues

• [Bug]: 12 packages in pnpm-lock.yaml have high or critical security advisories #23907: The issue describes updates to advisory-affected packages, including packages and the path-to-regexp override changed here.

Possibly related PRs

• pingdotgg/t3code#24913: Updates dompurify from 3.4.16 to 3.4.17, matching an update in this pull request, and includes related dependency fixes.
• pingdotgg/t3code#23988: Adds validation for dependency inputs changed in this pull request.

Suggested reviewers: t3dotgg

Merge Risk: Minimal · up to 6c422

The dependency updates are ready to merge based on the reviewed evidence.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the dependency updates that address high and critical security advisories.
Description check		The description includes all required sections. It explains the advisories, dependency changes, scope, issue reference, verification results, and untested areas.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}