2025-08-19 07:36:42 -07:00
|
|
|
packages:
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
- apps/*
|
|
|
|
|
- packages/*
|
|
|
|
|
- "!apps/api"
|
|
|
|
|
- "!apps/proxy"
|
2025-08-19 07:36:42 -07:00
|
|
|
|
2025-09-01 19:42:56 +05:30
|
|
|
catalog:
|
2026-05-31 15:56:12 +05:30
|
|
|
"@atlaskit/pragmatic-drag-and-drop": "1.7.4"
|
|
|
|
|
"@atlaskit/pragmatic-drag-and-drop-auto-scroll": "1.4.0"
|
|
|
|
|
"@atlaskit/pragmatic-drag-and-drop-hitbox": "1.1.0"
|
|
|
|
|
"@base-ui-components/react": "1.0.0-beta.3"
|
|
|
|
|
"@blueprintjs/core": "^4.16.3"
|
|
|
|
|
"@blueprintjs/popover2": "^1.13.3"
|
|
|
|
|
"@bprogress/core": "^1.3.4"
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"@chromatic-com/storybook": "5.2.1"
|
2026-05-31 15:56:12 +05:30
|
|
|
"@effect/platform": "^0.94.0"
|
|
|
|
|
"@effect/platform-node": "^0.104.0"
|
|
|
|
|
"@floating-ui/dom": "^1.7.1"
|
|
|
|
|
"@floating-ui/react": "^0.26.4"
|
|
|
|
|
"@fontsource-variable/inter": "5.2.8"
|
|
|
|
|
"@fontsource/ibm-plex-mono": "5.2.7"
|
|
|
|
|
"@fontsource/inter": "5.2.8"
|
|
|
|
|
"@fontsource/material-symbols-rounded": "5.2.30"
|
|
|
|
|
"@headlessui/react": "^1.7.19"
|
|
|
|
|
"@hocuspocus/extension-database": "2.15.2"
|
|
|
|
|
"@hocuspocus/extension-logger": "2.15.2"
|
|
|
|
|
"@hocuspocus/extension-redis": "2.15.2"
|
|
|
|
|
"@hocuspocus/provider": "2.15.2"
|
|
|
|
|
"@hocuspocus/server": "2.15.2"
|
|
|
|
|
"@hocuspocus/transformer": "2.15.2"
|
|
|
|
|
"@hypermod/utils": "^0.7.1"
|
|
|
|
|
"@popperjs/core": "^2.11.8"
|
|
|
|
|
"@radix-ui/react-scroll-area": "^1.2.3"
|
|
|
|
|
"@react-pdf/renderer": "^4.3.0"
|
|
|
|
|
"@react-pdf/types": "^2.9.2"
|
2026-06-05 00:51:33 +05:30
|
|
|
"@react-router/dev": "7.15.0"
|
|
|
|
|
"@react-router/node": "7.15.0"
|
|
|
|
|
"@react-router/serve": "7.15.0"
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"@storybook/addon-designs": "11.1.3"
|
|
|
|
|
"@storybook/addon-docs": "10.4.6"
|
|
|
|
|
"@storybook/addon-links": "10.4.6"
|
|
|
|
|
"@storybook/addon-onboarding": "10.4.6"
|
|
|
|
|
"@storybook/addon-styling-webpack": "3.0.2"
|
|
|
|
|
"@storybook/addon-webpack5-compiler-swc": "4.0.3"
|
|
|
|
|
"@storybook/react": "10.4.6"
|
|
|
|
|
"@storybook/react-vite": "10.4.6"
|
|
|
|
|
"@storybook/react-webpack5": "10.4.6"
|
2026-05-31 15:56:12 +05:30
|
|
|
"@tailwindcss/postcss": "4.1.17"
|
|
|
|
|
"@tailwindcss/typography": "0.5.19"
|
|
|
|
|
"@tanstack/react-table": "^8.21.3"
|
|
|
|
|
"@tanstack/react-virtual": "^3.13.12"
|
|
|
|
|
"@tanstack/virtual-core": "^3.13.12"
|
|
|
|
|
"@tiptap/core": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-blockquote": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-character-count": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-collaboration": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-document": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-emoji": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-heading": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-image": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-list-item": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-mention": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-placeholder": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-task-item": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-task-list": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-text": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-text-align": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-text-style": "^2.22.3"
|
|
|
|
|
"@tiptap/extension-underline": "^2.22.3"
|
|
|
|
|
"@tiptap/html": "^2.22.3"
|
|
|
|
|
"@tiptap/pm": "^2.22.3"
|
|
|
|
|
"@tiptap/react": "^2.22.3"
|
|
|
|
|
"@tiptap/starter-kit": "^2.22.3"
|
|
|
|
|
"@tiptap/suggestion": "^2.22.3"
|
|
|
|
|
"@types/chroma-js": "^3.1.2"
|
|
|
|
|
"@types/compression": "1.8.1"
|
|
|
|
|
"@types/cors": "^2.8.17"
|
|
|
|
|
"@types/express": "4.17.23"
|
|
|
|
|
"@types/express-ws": "^3.0.5"
|
|
|
|
|
"@types/hast": "^3.0.4"
|
|
|
|
|
"@types/jscodeshift": "^17.3.0"
|
|
|
|
|
"@types/lodash-es": "4.17.12"
|
|
|
|
|
"@types/mdast": "^4.0.4"
|
|
|
|
|
"@types/node": "22.12.0"
|
|
|
|
|
"@types/pdf-parse": "^1.1.5"
|
|
|
|
|
"@types/react": "18.3.11"
|
|
|
|
|
"@types/react-color": "^3.0.9"
|
|
|
|
|
"@types/react-dom": "18.3.1"
|
|
|
|
|
"@types/sanitize-html": "2.16.0"
|
|
|
|
|
"@types/ws": "^8.18.1"
|
2026-06-05 00:51:33 +05:30
|
|
|
"@vitest/coverage-v8": "^4.1.8"
|
2026-05-31 15:56:12 +05:30
|
|
|
"ast-types": "0.14.2"
|
|
|
|
|
"autoprefixer": "^10.4.19"
|
chore(deps): resolve open Dependabot security alerts (#9456)
Bumps three dependencies flagged by Dependabot, closing all 7 open alerts:
- axios 1.16.0 -> 1.18.1 (catalog), closing 5 alerts:
GHSA-gcfj-64vw-6mp9 (high, inherited proxy after interceptor config clone),
GHSA-hcpx-6fm6-wx23, GHSA-mwf2-3pr3-8698, GHSA-f4gw-2p7v-4548,
GHSA-xj6q-8x83-jv6g. Dependabot proposed 1.18.0; 1.18.1 is a pure bugfix
release on top of it that also fixes runtime crashes and AxiosError
circular-serialisation, so it is used instead. Supersedes PR #9447.
- brace-expansion 5.0.6 -> 5.0.7 (override), closing GHSA-3jxr-9vmj-r5cp
(high, DoS via exponential-time expansion of consecutive {} groups).
- morgan -> 1.11.0 (new override), closing GHSA-4vj7-5mj6-jm8m (log forging
via unneutralized control characters in :remote-user). Pulled in
transitively by @react-router/serve.
Verified: check:types 28/28, check:lint 16/16, build 16/16.
2026-07-22 00:26:18 +05:30
|
|
|
"axios": "1.18.1"
|
2026-05-31 15:56:12 +05:30
|
|
|
"buffer": "^6.0.3"
|
|
|
|
|
"chroma-js": "^3.2.0"
|
|
|
|
|
"class-variance-authority": "0.7.1"
|
|
|
|
|
"clsx": "^2.1.1"
|
|
|
|
|
"cmdk": "^1.1.1"
|
|
|
|
|
"comlink": "^4.4.1"
|
|
|
|
|
"compression": "1.8.1"
|
|
|
|
|
"cors": "^2.8.5"
|
|
|
|
|
"date-fns": "^4.1.0"
|
|
|
|
|
"dotenv": "16.4.7"
|
|
|
|
|
"effect": "3.20.0"
|
|
|
|
|
"emoji-picker-react": "^4.5.16"
|
|
|
|
|
"emoji-regex": "^10.3.0"
|
|
|
|
|
"export-to-csv": "^1.4.0"
|
|
|
|
|
"express": "4.22.0"
|
|
|
|
|
"express-winston": "^4.2.0"
|
|
|
|
|
"express-ws": "^5.0.2"
|
|
|
|
|
"file-type": "^21.3.1"
|
|
|
|
|
"framer-motion": "^12.23.0"
|
|
|
|
|
"frimousse": "^0.3.0"
|
|
|
|
|
"hast": "^1.0.0"
|
|
|
|
|
"hast-util-to-mdast": "^10.1.2"
|
|
|
|
|
"helmet": "^7.1.0"
|
|
|
|
|
"highlight.js": "^11.8.0"
|
|
|
|
|
"husky": "9.1.7"
|
|
|
|
|
"i18next": "25.10.9"
|
|
|
|
|
"i18next-icu": "2.4.3"
|
|
|
|
|
"i18next-resources-to-backend": "1.2.1"
|
|
|
|
|
"ioredis": "5.7.0"
|
|
|
|
|
"is-emoji-supported": "^0.0.5"
|
|
|
|
|
"isbot": "^5.1.31"
|
|
|
|
|
"jscodeshift": "^17.3.0"
|
|
|
|
|
"jsx-dom-cjs": "^8.0.3"
|
|
|
|
|
"linkifyjs": "^4.3.2"
|
|
|
|
|
"lint-staged": "16.2.7"
|
|
|
|
|
"lodash-es": "4.18.1"
|
|
|
|
|
"lowlight": "^3.0.0"
|
|
|
|
|
"lucide-react": "0.469.0"
|
|
|
|
|
"mdast": "^3.0.0"
|
|
|
|
|
"mobx": "6.12.0"
|
|
|
|
|
"mobx-react": "9.1.1"
|
|
|
|
|
"mobx-utils": "6.0.8"
|
|
|
|
|
"next-themes": "0.4.6"
|
|
|
|
|
"oxfmt": "0.35.0"
|
|
|
|
|
"oxlint": "1.51.0"
|
|
|
|
|
"pdf-parse": "^2.4.5"
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"postcss": "8.5.15"
|
2026-05-31 15:56:12 +05:30
|
|
|
"postcss-cli": "^11.0.0"
|
|
|
|
|
"postcss-nested": "^6.0.1"
|
|
|
|
|
"prosemirror-codemark": "^0.4.2"
|
|
|
|
|
"react": "18.3.1"
|
|
|
|
|
"react-color": "^2.19.3"
|
|
|
|
|
"react-day-picker": "9.5.0"
|
|
|
|
|
"react-dom": "18.3.1"
|
|
|
|
|
"react-dropzone": "^14.2.3"
|
|
|
|
|
"react-fast-compare": "^3.2.2"
|
|
|
|
|
"react-hook-form": "7.51.5"
|
|
|
|
|
"react-i18next": "16.6.6"
|
|
|
|
|
"react-is": "^18.2.0"
|
|
|
|
|
"react-markdown": "^8.0.7"
|
|
|
|
|
"react-masonry-component": "^6.3.0"
|
|
|
|
|
"react-pdf-html": "^2.1.2"
|
|
|
|
|
"react-popper": "^2.3.0"
|
2026-06-16 17:17:08 +05:30
|
|
|
"react-router": "7.15.1"
|
2026-05-31 15:56:12 +05:30
|
|
|
"recharts": "^2.15.1"
|
|
|
|
|
"reflect-metadata": "^0.2.2"
|
|
|
|
|
"rehype-parse": "^9.0.1"
|
|
|
|
|
"rehype-remark": "^10.0.1"
|
|
|
|
|
"remark-gfm": "^4.0.1"
|
|
|
|
|
"remark-stringify": "^11.0.0"
|
|
|
|
|
"sanitize-html": "2.17.0"
|
|
|
|
|
"serve": "14.2.5"
|
|
|
|
|
"sharp": "^0.34.3"
|
|
|
|
|
"smooth-scroll-into-view-if-needed": "^2.0.2"
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"storybook": "10.4.6"
|
2026-05-31 15:56:12 +05:30
|
|
|
"swr": "2.2.4"
|
|
|
|
|
"tailwind-merge": "3.4.0"
|
|
|
|
|
"tailwindcss": "4.1.17"
|
|
|
|
|
"tippy.js": "^6.3.7"
|
|
|
|
|
"tiptap-markdown": "^0.8.10"
|
|
|
|
|
"tsdown": "0.16.0"
|
|
|
|
|
"tsx": "4.20.6"
|
fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)
Resolves the sole open Dependabot alert (GHSA-gv7w-rqvm-qjhr, high):
esbuild <0.28.1 lacks binary-integrity verification in its Deno install
path, enabling RCE via NPM_CONFIG_REGISTRY. The pnpm `overrides` entry
pinned the entire tree to esbuild 0.25.0; bump it to 0.28.1, which fixes
all transitive paths (vite, vitest, tsx, vite-node, esbuild-register).
Also bump turbo 2.9.14 -> 2.9.18 in the workspace catalog and the four
pinned production Dockerfiles (web, live, admin, space).
Verified: `pnpm audit` clean, admin react-router/vite build succeeds,
@plane/codemods vitest suite 33/33 passing.
2026-06-15 13:15:40 +05:30
|
|
|
"turbo": "2.9.18"
|
2026-05-31 15:56:12 +05:30
|
|
|
"typescript": "5.8.3"
|
|
|
|
|
"unified": "^11.0.5"
|
|
|
|
|
"use-font-face-observer": "^1.3.0"
|
|
|
|
|
"uuid": "14.0.0"
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"vite": "8.0.16"
|
2026-05-31 15:56:12 +05:30
|
|
|
"vite-tsconfig-paths": "^5.1.4"
|
2026-06-05 00:51:33 +05:30
|
|
|
"vitest": "^4.1.8"
|
2026-05-31 15:56:12 +05:30
|
|
|
"winston": "^3.17.0"
|
2026-06-16 17:17:08 +05:30
|
|
|
"ws": "8.21.0"
|
2026-05-31 15:56:12 +05:30
|
|
|
"y-indexeddb": "^9.0.12"
|
|
|
|
|
"y-prosemirror": "^1.3.7"
|
|
|
|
|
"y-protocols": "^1.0.6"
|
|
|
|
|
"yjs": "^13.6.20"
|
|
|
|
|
"zod": "^3.25.76"
|
2025-09-01 19:42:56 +05:30
|
|
|
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
overrides:
|
|
|
|
|
express: "catalog:"
|
|
|
|
|
mdast-util-to-hast: 13.2.1
|
|
|
|
|
valibot: 1.2.0
|
|
|
|
|
glob: 11.1.0
|
chore(deps): resolve open Dependabot security alerts (#9456)
Bumps three dependencies flagged by Dependabot, closing all 7 open alerts:
- axios 1.16.0 -> 1.18.1 (catalog), closing 5 alerts:
GHSA-gcfj-64vw-6mp9 (high, inherited proxy after interceptor config clone),
GHSA-hcpx-6fm6-wx23, GHSA-mwf2-3pr3-8698, GHSA-f4gw-2p7v-4548,
GHSA-xj6q-8x83-jv6g. Dependabot proposed 1.18.0; 1.18.1 is a pure bugfix
release on top of it that also fixes runtime crashes and AxiosError
circular-serialisation, so it is used instead. Supersedes PR #9447.
- brace-expansion 5.0.6 -> 5.0.7 (override), closing GHSA-3jxr-9vmj-r5cp
(high, DoS via exponential-time expansion of consecutive {} groups).
- morgan -> 1.11.0 (new override), closing GHSA-4vj7-5mj6-jm8m (log forging
via unneutralized control characters in :remote-user). Pulled in
transitively by @react-router/serve.
Verified: check:types 28/28, check:lint 16/16, build 16/16.
2026-07-22 00:26:18 +05:30
|
|
|
brace-expansion: 5.0.7
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
nanoid: 3.3.8
|
fix: resolve esbuild advisory and bump turbo to 2.9.18 (#9236)
Resolves the sole open Dependabot alert (GHSA-gv7w-rqvm-qjhr, high):
esbuild <0.28.1 lacks binary-integrity verification in its Deno install
path, enabling RCE via NPM_CONFIG_REGISTRY. The pnpm `overrides` entry
pinned the entire tree to esbuild 0.25.0; bump it to 0.28.1, which fixes
all transitive paths (vite, vitest, tsx, vite-node, esbuild-register).
Also bump turbo 2.9.14 -> 2.9.18 in the workspace catalog and the four
pinned production Dockerfiles (web, live, admin, space).
Verified: `pnpm audit` clean, admin react-router/vite build succeeds,
@plane/codemods vitest suite 33/33 passing.
2026-06-15 13:15:40 +05:30
|
|
|
esbuild: 0.28.1
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"@babel/core": 7.29.7
|
|
|
|
|
"@babel/helpers": 7.29.7
|
|
|
|
|
"@babel/runtime": 7.29.7
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
chokidar: 3.6.0
|
|
|
|
|
prosemirror-view: 1.40.0
|
|
|
|
|
"@types/express": 4.17.23
|
|
|
|
|
typescript: "catalog:"
|
|
|
|
|
vite: "catalog:"
|
2026-06-01 18:37:35 +05:30
|
|
|
qs: 6.15.2
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
diff: 5.2.2
|
|
|
|
|
webpack: 5.104.1
|
|
|
|
|
lodash-es: "catalog:"
|
|
|
|
|
lodash: 4.18.1
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
markdown-it: 14.2.0
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
rollup: 4.59.0
|
|
|
|
|
"minimatch@3": 3.1.4
|
|
|
|
|
"minimatch@10": 10.2.3
|
|
|
|
|
serialize-javascript: 7.0.5
|
|
|
|
|
"ajv@6": 6.14.0
|
|
|
|
|
"ajv@8": 8.18.0
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
"undici@7": 7.28.0
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
flatted: 3.4.2
|
|
|
|
|
picomatch: 2.3.2
|
|
|
|
|
"yaml@1": 1.10.3
|
|
|
|
|
"yaml@2": 2.8.3
|
|
|
|
|
path-to-regexp: 0.1.13
|
|
|
|
|
defu: 6.1.5
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
postcss: 8.5.15
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
axios: "catalog:"
|
|
|
|
|
follow-redirects: 1.16.0
|
|
|
|
|
uuid: "catalog:"
|
|
|
|
|
"fast-uri@<3.1.2": ">=3.1.2"
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
tmp: 0.2.7
|
|
|
|
|
form-data: 4.0.6
|
|
|
|
|
"ws@8": 8.21.0
|
|
|
|
|
"ws@7": 7.5.11
|
|
|
|
|
"@opentelemetry/core": 2.8.0
|
|
|
|
|
"@opentelemetry/resources": 2.8.0
|
|
|
|
|
"@opentelemetry/sdk-trace-base": 2.8.0
|
chore(deps): resolve open Dependabot security alerts (#9456)
Bumps three dependencies flagged by Dependabot, closing all 7 open alerts:
- axios 1.16.0 -> 1.18.1 (catalog), closing 5 alerts:
GHSA-gcfj-64vw-6mp9 (high, inherited proxy after interceptor config clone),
GHSA-hcpx-6fm6-wx23, GHSA-mwf2-3pr3-8698, GHSA-f4gw-2p7v-4548,
GHSA-xj6q-8x83-jv6g. Dependabot proposed 1.18.0; 1.18.1 is a pure bugfix
release on top of it that also fixes runtime crashes and AxiosError
circular-serialisation, so it is used instead. Supersedes PR #9447.
- brace-expansion 5.0.6 -> 5.0.7 (override), closing GHSA-3jxr-9vmj-r5cp
(high, DoS via exponential-time expansion of consecutive {} groups).
- morgan -> 1.11.0 (new override), closing GHSA-4vj7-5mj6-jm8m (log forging
via unneutralized control characters in :remote-user). Pulled in
transitively by @react-router/serve.
Verified: check:types 28/28, check:lint 16/16, build 16/16.
2026-07-22 00:26:18 +05:30
|
|
|
morgan: 1.11.0
|
chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml (#9147)
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
2026-05-27 16:06:15 +05:30
|
|
|
|
|
|
|
|
allowBuilds:
|
|
|
|
|
"@parcel/watcher": true
|
|
|
|
|
"@swc/core": true
|
|
|
|
|
esbuild: true
|
|
|
|
|
msgpackr-extract: true
|
|
|
|
|
turbo: true
|
|
|
|
|
sharp: false
|
chore(deps): upgrade Storybook to v10 and fix security advisories (#9277)
Storybook upgrade (latest 10.4.6):
- Align catalog so storybook + all @storybook/* are lockstep on 10.4.6
- addon-designs 11.1.3, addon-styling-webpack 3.0.2,
addon-webpack5-compiler-swc 4.0.3, @chromatic-com/storybook 5.2.1
- Remove discontinued packages (addon-essentials, addon-interactions,
blocks, test); add @storybook/addon-docs to packages/ui
- Fix .storybook/main.ts ESM loading via createRequire(import.meta.url)
- Revert propel's hardcoded storybook version back to catalog:
Security advisories:
- undici 7.24.0 -> 7.28.0 (7 CVEs incl. GHSA-vmh5-mc38-953g)
- @opentelemetry/core|resources|sdk-trace-base -> 2.8.0
(GHSA-8988-4f7v-96qf)
Also includes bundled dependency bumps already pending on the branch
(vite 8, postcss, babel, markdown-it, ws, form-data, etc.).
2026-06-20 17:08:01 +05:30
|
|
|
|
|
|
|
|
minimumReleaseAgeExclude:
|
|
|
|
|
- '@storybook/addon-docs@10.4.6'
|
|
|
|
|
- '@storybook/builder-vite@10.4.6'
|
|
|
|
|
- '@storybook/csf-plugin@10.4.6'
|
|
|
|
|
- '@storybook/react-dom-shim@10.4.6'
|
|
|
|
|
- '@storybook/react-vite@10.4.6'
|
|
|
|
|
- '@storybook/react@10.4.6'
|
|
|
|
|
- storybook@10.4.6
|