Skip to content

chore(deps): bump lerna to ^9.0.7 to resolve remaining dev-tooling advisories #6499

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
antonis wants to merge 2 commits into
base: main
Choose a base branch
from
+1,988 −1,282
Draft

chore(deps): bump lerna to ^9.0.7 to resolve remaining dev-tooling advisories #6499

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ae4597
chore(deps): bump lerna to ^9.0.7 to resolve dev-tooling security adv…
antonis Jul 22, 2026
adad396
chore(deps): drop resolutions made dead by the lerna 9 bump
antonis Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 5 additions & 9 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"@sentry/cli": "3.6.1",
"downlevel-dts": "^0.11.0",
"google-java-format": "^1.4.0",
"lerna": "^8.1.8",
"lerna": "^9.0.7",

@cursor cursor Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lerna 9 drops Node 18

High Severity

Flagged because the dependency-update review guidelines call out new requirements from major bumps. lerna ^9.0.7 (and transitive nx 22) require Node ^20.19.0 || ^22.12.0 || >=24.0.0, but Volta still pins 18.20.8 and CI workflows still use node-version: 18. Build, test, and lerna version in release therefore run on an unsupported Node.

Additional Locations (1)
Fix in Cursor Fix in Web

Triggered by project rule: PR Review Guidelines for Cursor Bot

Reviewed by Cursor Bugbot for commit adad396. Configure here.

@antonis antonis Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Marking as blocked for now since this is a valid concern that needs to be investigated in detail. All the issues that this PR fixes are dev only and do not affect production anyway.

"npm-run-all2": "^6.2.2",
"oxfmt": "^0.42.0",
"oxlint": "^1.56.0",
Expand Down Expand Up @@ -66,18 +66,13 @@
"@istanbuljs/load-nyc-config@npm:1.1.0/js-yaml": "^3.15.0",
"@yarnpkg/parsers@npm:3.0.0-rc.46/js-yaml": "^3.15.0",
"cosmiconfig@npm:5.2.1/js-yaml": "^3.15.0",
"front-matter@npm:4.0.2/js-yaml": "^3.15.0",
"js-yaml": "^4.3.0",
"detox@npm:20.46.0/ajv": "^8.18.0",
"@expo/fingerprint@npm:0.6.1/minimatch": "^3.1.3",
"@lerna/create@npm:8.1.8/minimatch": "^3.1.3",
"glob@npm:6.0.4/minimatch": "^3.1.3",
"glob@npm:7.1.6/minimatch": "^3.1.3",
"glob@npm:7.2.3/minimatch": "^3.1.3",
"jake@npm:10.9.2/minimatch": "^3.1.3",
"lerna@npm:8.1.8/minimatch": "^3.1.3",
"multimatch@npm:5.0.0/minimatch": "^3.1.3",
"node-dir@npm:0.1.17/minimatch": "^3.1.3",
"test-exclude@npm:6.0.0/minimatch": "^3.1.3",
"filelist@npm:1.0.4/minimatch": "^5.1.8",
"glob@npm:8.1.0/minimatch": "^5.1.8",
Expand All @@ -94,9 +89,7 @@
"@typescript-eslint/typescript-estree@npm:6.21.0/minimatch": "^9.0.7",
"editorconfig@npm:1.0.4/minimatch": "^9.0.7",
"glob@npm:10.5.0/minimatch": "^9.0.7",
"ignore-walk@npm:6.0.5/minimatch": "^9.0.7",
"npm-run-all2@npm:6.2.2/minimatch": "^9.0.7",
"nx@npm:19.6.4/minimatch": "^9.0.7",
"webdriverio@npm:8.40.5/minimatch": "^9.0.7",
"glob@npm:13.0.0/minimatch": "^10.2.3",
"glob@npm:^10.0.0": "^10.5.0",
Expand All @@ -120,7 +113,10 @@
"@expo/metro-config@npm:55.0.9/picomatch": "^4.0.4",
"npm-run-all2@npm:8.0.4/picomatch": "^4.0.4",
"tinyglobby@npm:0.2.15/picomatch": "^4.0.4",
"minimatch@npm:10.2.4/brace-expansion": "^5.0.5",
"minimatch@npm:10.2.4/brace-expansion": "^5.0.7",
"brace-expansion@npm:^5.0.2": "^5.0.7",
"brace-expansion@npm:^5.0.5": "^5.0.7",
"brace-expansion@npm:5.0.6": "^5.0.7",
"@appium/base-driver@npm:10.2.2/path-to-regexp": "^8.4.0",
"router@npm:2.2.0/path-to-regexp": "^8.4.0",
"yaml": "^2.8.3",
Expand Down
Loading
Loading