Merge pull request #158 from sauravpanda/saurav/eng-5625-fix-dependabot-vulnerabilities-in-browser-usebrowsercode-24

security: fix Dependabot alerts in dompurify, astro, and @babel/core

Author: sauravpanda

bun.lock

@@ -60,7 +60,7 @@
       "@solid-primitives/storage": "4.3.3",
       "@tailwindcss/vite": "4.1.11",
       "diff": "8.0.2",
-      "dompurify": "3.4.11",
+      "dompurify": "3.4.13",
       "drizzle-kit": "1.0.0-rc.2",
       "drizzle-orm": "1.0.0-rc.2",
       "effect": "4.0.0-beta.83",
@@ -89,7 +89,7 @@
       "@solidjs/start": "https://pkg.pr.new/@solidjs/start@dfb2020",
       "@sentry/solid": "10.36.0",
       "@sentry/vite-plugin": "4.6.0",
-      "solid-js": "1.9.10",
+      "solid-js": "1.9.15",
       "vite-plugin-solid": "2.11.10",
       "@lydell/node-pty": "1.2.0-beta.12"
     }
@@ -139,6 +139,7 @@
     "@opentui/core": "catalog:",
     "@opentui/keymap": "catalog:",
     "@opentui/solid": "catalog:",
+    "solid-js": "catalog:",
     "@types/bun": "catalog:",
     "@types/node": "catalog:",
     "postcss": "8.5.16",
@@ -147,15 +148,14 @@
     "@opentelemetry/sdk-trace-base": "2.9.0",
     "@opentelemetry/resources": "2.9.0",
     "@opentelemetry/sdk-trace-node": "2.9.0",
-    "astro": "6.4.8",
-    "@astrojs/starlight": "0.40.0"
+    "astro": "7.1.0",
+    "@astrojs/starlight": "0.41.7"
   },
   "patchedDependencies": {
     "@ff-labs/[email protected]": "patches/@ff-labs%[email protected]",
     "@npmcli/[email protected]": "patches/@npmcli%[email protected]",
     "@silvia-odwyer/[email protected]": "patches/@silvia-odwyer%[email protected]",
     "@standard-community/[email protected]": "patches/@standard-community%[email protected]",
-    "[email protected]": "patches/[email protected]",
     "@ai-sdk/[email protected]": "patches/@ai-sdk%[email protected]",
     "[email protected]": "patches/[email protected]",
     "[email protected]": "patches/[email protected]",

package.json

@@ -29,7 +29,7 @@
     }
   },
   "devDependencies": {
-    "@babel/core": "7.28.4",
+    "@babel/core": "7.29.6",
     "@octokit/webhooks-types": "7.6.1",
     "@opencode-ai/core": "workspace:*",
     "@opencode-ai/http-recorder": "workspace:*",

packages/opencode/package.json

@@ -52,7 +52,7 @@
     "@solidjs/meta": "catalog:",
     "@solidjs/router": "catalog:",
     "diff": "catalog:",
-    "dompurify": "3.3.1",
+    "dompurify": "3.4.13",
     "fuzzysort": "catalog:",
     "katex": "0.16.27",
     "luxon": "catalog:",

packages/session-ui/package.json

@@ -89,7 +89,7 @@
     "@solid-primitives/resize-observer": "2.1.3",
     "@shikijs/stream": "catalog:",
     "diff": "catalog:",
-    "dompurify": "3.4.11",
+    "dompurify": "3.4.13",
     "fuzzysort": "catalog:",
     "katex": "0.16.27",
     "luxon": "catalog:",

packages/ui/package.json

@@ -21,7 +21,7 @@ export default defineConfig({
     // when unset (plain `astro build`) this is undefined and the adapter falls
     // back to its default config detection.
     configPath: process.env.SST_WRANGLER_PATH,
-    // @astrojs/cloudflare v13 defaults to prerendering in the workerd runtime,
+    // @astrojs/cloudflare v13+ defaults to prerendering in the workerd runtime,
     // which lacks Node built-ins (path/fs/url) that Astro/Zod internals import.
     // Prerender in Node instead, matching the previous (v12) behavior.
     prerenderEnvironment: "node",

packages/web/astro.config.mjs

@@ -12,16 +12,16 @@
     "astro": "astro"
   },
   "dependencies": {
-    "@astrojs/cloudflare": "13.7.0",
-    "@astrojs/markdown-remark": "7.2.0",
-    "@astrojs/solid-js": "6.0.1",
-    "@astrojs/starlight": "0.40.0",
+    "@astrojs/cloudflare": "14.1.7",
+    "@astrojs/markdown-remark": "7.2.1",
+    "@astrojs/solid-js": "7.0.2",
+    "@astrojs/starlight": "0.41.7",
     "@fontsource/ibm-plex-mono": "5.2.5",
     "@shikijs/transformers": "3.20.0",
     "@solid-primitives/resize-observer": "2.1.5",
     "@types/luxon": "catalog:",
     "ai": "catalog:",
-    "astro": "6.4.8",
+    "astro": "7.1.0",
     "diff": "catalog:",
     "js-base64": "3.7.7",
     "lang-map": "0.4.0",

packages/web/package.json

@@ -8,8 +8,8 @@ index 04cb0f7f1265123ea3319a78527c42155fca7fbf..3d3385ff2131cf9975d8d2619715d08c
    "peerDependencies": {
 -    "@astrojs/starlight": "^0.34.3",
 -    "astro": "^5.7.13"
-+    "@astrojs/starlight": "^0.34.3 || ^0.40.0",
-+    "astro": "^5.7.13 || ^6.4.5"
++    "@astrojs/starlight": "^0.34.3 || ^0.40.0 || ^0.41.0",
++    "astro": "^5.7.13 || ^6.4.5 || ^7.0.2"
    }
  }
 \ No newline at end of file