chore(deps): Add mdx-builder scanning and patch vulns #4138
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
4 Skipped Deployments
|
davidkonigsberg
temporarily deployed
to
Fern Dev
GitHub Actions
Inactive
davidkonigsberg
temporarily deployed
to
Fern Dev
GitHub Actions
Inactive
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
davidkonigsberg
temporarily deployed
to
Fern Dev
GitHub Actions
Inactive
davidkonigsberg
temporarily deployed
to
Fern Dev
GitHub Actions
Inactive
davidkonigsberg
temporarily deployed
to
Fern Dev
GitHub Actions
Inactive
|
|
||
| # Create package.json and install dependencies locally | ||
| RUN echo '{"name": "mdx-bundler-server", "dependencies": {"typescript": "^5", "esbuild": "0.25.9", "react": ">=18.2.0", "@aa-sdk/core": "^4.31.2", "@account-kit/core": "^4.31.2", "@account-kit/infra": "^4.32.0", "@account-kit/react": "^4.31.2", "@account-kit/react-native": "^4.31.2", "@account-kit/react-native-signer": "^4.31.2", "@account-kit/signer": "^4.31.2", "@account-kit/smart-contracts": "^4.31.2", "@shikijs/rehype": "^3.2.1", "@shikijs/transformers": "^3.2.1", "@shikijs/twoslash": "^3.2.1", "@tanstack/react-query": "^5.71.1", "@types/cors": "^2.8.13", "@types/express": "^4.17.13", "@types/hast": "^3.0.4", "@types/jest": "^29.5.14", "@types/mdast": "^4.0.4", "@types/mdx": "^2.0.13", "@types/node": "^20.17.32", "@types/react": "19.0.10", "@types/react-dom": "19.0.4", "@typescript/vfs": "^1.6.1", "@vercel/node": "^2.9.6", "cors": "^2.8.5", "es-toolkit": "^1.32.0", "estree-util-to-js": "^2.0.0", "estree-walker": "^3.0.3", "express": "^5.0.0", "hast-util-properties-to-mdx-jsx-attributes": "^1.0.0", "hast-util-to-estree": "^3.1.1", "mdast": "^3.0.0", "mdast-util-directive": "^3.1.0", "mdast-util-from-markdown": "^2.0.2", "mdast-util-gfm": "^3.0.0", "mdast-util-to-hast": "^13.2.0", "mdx-bundler": "^10.1.1", "parse-numeric-range": "^1.3.0", "path-to-regexp": "^6.3.0", "qrcode.react": "^4.2.0", "react-dom": "19.0.0", "react-native": "^0.79.2", "shiki": "^3.2.1", "ts-essentials": "^10.0.4", "tsup": "^8.3.5", "tsx": "^4.7.1", "twoslash": "^0.3.1", "unified": "^11.0.5", "unist-util-visit": "^5.0.0", "viem": "^2.29.0", "vitest": "^3.1.3", "yaml": "^2.3.1"}}' > package.json | ||
| RUN echo '{"name": "mdx-bundler-server", "dependencies": {"typescript": "^5", "esbuild": "0.25.9", "react": ">=18.2.0", "@aa-sdk/core": "^4.31.2", "@account-kit/core": "^4.31.2", "@account-kit/infra": "^4.32.0", "@account-kit/react": "^4.31.2", "@account-kit/react-native": "^4.31.2", "@account-kit/react-native-signer": "^4.31.2", "@account-kit/signer": "^4.31.2", "@account-kit/smart-contracts": "^4.31.2", "@shikijs/rehype": "^3.2.1", "@shikijs/transformers": "^3.2.1", "@shikijs/twoslash": "^3.2.1", "@tanstack/react-query": "^5.71.1", "@types/cors": "^2.8.13", "@types/express": "^4.17.13", "@types/hast": "^3.0.4", "@types/jest": "^29.5.14", "@types/mdast": "^4.0.4", "@types/mdx": "^2.0.13", "@types/node": "^20.17.32", "@types/react": "19.0.10", "@types/react-dom": "19.0.4", "@typescript/vfs": "^1.6.1", "@vercel/node": "^2.9.6", "cors": "^2.8.5", "es-toolkit": "^1.32.0", "estree-util-to-js": "^2.0.0", "estree-walker": "^3.0.3", "express": "^5.0.0", "hast-util-properties-to-mdx-jsx-attributes": "^1.0.1", "hast-util-to-estree": "^3.1.1", "mdast": "^3.0.0", "mdast-util-directive": "^3.1.0", "mdast-util-from-markdown": "^2.0.2", "mdast-util-gfm": "^3.0.0", "mdast-util-to-hast": "^13.2.0", "mdx-bundler": "^10.1.1", "parse-numeric-range": "^1.3.0", "path-to-regexp": "^6.3.0", "qrcode.react": "^4.2.0", "react-dom": "19.0.0", "react-native": "^0.79.2", "shiki": "^3.2.1", "ts-essentials": "^10.0.4", "tsup": "^8.3.5", "tsx": "^4.7.1", "twoslash": "^0.3.1", "unified": "^11.0.5", "unist-util-visit": "^5.0.0", "viem": "^2.29.0", "vitest": "^3.2.4", "yaml": "^2.3.1"},"overrides": {"esbuild": "0.25.9"}}' > package.json |
There was a problem hiding this comment.
The Dockerfile hardcodes esbuild version 0.25.9 but the catalog defines 0.25.0, creating a version mismatch that violates the project's strict esbuild versioning requirements.
View Details
📝 Patch Details
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 36660f32c..e35eb4fde 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -56,7 +56,7 @@ catalog:
# this exact esbuild version is used in fern docs dev build process
# if you update the esbuild version, you **must** ensure that other references match
# including fern-docs/bundle/package.json + cdk/utilities/install-esbuild.js
- "esbuild": "0.25.0"
+ "esbuild": "0.25.9"
"eslint-config-next": "15.5.4"
"hastscript": "^9.0.0"
"jose": "^5.9.6"
Analysis
esbuild version mismatch between Dockerfile and catalog causes build inconsistencies
What fails: Dockerfile hardcodes [email protected] while pnpm-workspace.yaml catalog defines 0.25.0, violating project's strict versioning requirements and causing build inconsistencies between containerized and local environments
How to reproduce:
- Check Dockerfile line 10:
"esbuild": "0.25.9" - Check pnpm-workspace.yaml catalog line 59:
"esbuild": "0.25.0" - Compare with CI workflows that override catalog to 0.25.9 for deployment
- Check install-esbuild.js which hardcodes
[email protected]paths
Result: Container builds use esbuild 0.25.9 while workspace uses 0.25.0, creating version inconsistencies despite catalog comment requiring all references to match
Expected: All esbuild references should use the same version per catalog documentation stating "you must ensure that other references match" when updating esbuild version
Per esbuild changelog, version 0.25.0 introduced breaking changes that could cause different bundling behavior between environments.
There was a problem hiding this comment.
I'm just copying the version already in use that was updated by Catherine last night. Didn't want to mess with other people's changes.
There was a problem hiding this comment.
In addition to the override, the only other change here is that I bumped up hast-util-properties-to-mdx-jsx-attributes to match the catalog since that is what is used in package.json for mdx-bundler
servers/mdx-bundler/package.json
Outdated
| "yaml": "^2.3.1" | ||
| }, | ||
| "overrides": { | ||
| "esbuild": "catalog:" |
There was a problem hiding this comment.
Added this here since I'm using it in the Dockerfile, happy to change to a hardcoded value of 0.25.9 if that is preferable
There was a problem hiding this comment.
actually, I'm gonna do that so it matches what is in the Dockerfile.
davidkonigsberg
temporarily deployed
to
Fern Dev
GitHub Actions
Inactive
vercel
bot
temporarily deployed
to
Preview – prod-assets.ferndocs.com
| }, | ||
| "dependencies": { | ||
| "esbuild": "catalog:" | ||
| "esbuild": "0.25.9" |
There was a problem hiding this comment.
There were changed to match the Dockerfile. If we use catalog, it will be 0.25.0. @chdeskur is it possible that we want to update the catalog to reflect the changes you made yesterday to get everything on 0.25.9?
2 participants
Short description of the changes made
Added CI to build/upload mdx-builder container for scanning
Perform base image update identical to what I did for FDR. New build of node22 while retaining alpine3.20
Add an override for esbuild to patch vulns
What was the motivation & context behind this PR?
soc2 vulnerability patching
Drops vulnerabilities count from 81 (4/41/34/2/0) to 10 (0/5/4/1/0)
How has this PR been tested?
CI
Before
After
