chore(deps): consolidate JS dependency upgrades (security + maintenance) by mekarpeles · Pull Request #12559 · internetarchive/openlibrary

mekarpeles · 2026-05-03T19:40:41Z

Summary

Consolidates 11 open Renovate PRs into a single tested and verified upgrade. All packages were installed and tested in Docker (full OL stack on port 8080 with OL_MOUNT_DIR mount) before opening this PR.

🔴 Security upgrades

Package	Before	After	CVE / Notes	Closes
lodash	4.17.21	4.18.1	Security release	#11795
qs (override)	6.5.3	6.14.1	Security release	#11641
svgo	2.3.1	4	CVE-2026-29074 (DoS via entity expansion / billion laughs)	#12010
vite	8.0.3	8.0.5 (lock)	Security release	#12305

lodash — Named method imports only; all stable 4.x APIs. Risk: low.

qs — Transitive dep via overrides["@ericblade/quagga2"], not imported directly. Risk: low.

svgo 2.3.1 → 4 — Fixes CVE-2026-29074. Required config migration: extendDefaultPlugins() removed in v3, replaced with preset-default + overrides in conf/svgo.config.js. Re-ran npm run svg-min; re-optimized SVG output included. Build-time only. Risk: medium.

vite — Lock-only patch, build-time only. Risk: very low.

🔧 Maintenance upgrades

Package	Before	After	Notes	Closes
tesseract.js	4.1.1	4.1.4	Patch; used in BarcodeScanner	#10975
@vitejs/plugin-vue	6.0.5	6.0.6	Lock-only patch; build tool	#12447
@babel/eslint-parser	7.24.7	7.28.6	Lock-only minor; lint tool	#12200
mini-css-extract-plugin	2.9.2	2.10.2	Lock-only minor; webpack plugin	#11126
@babel/preset-env	7.24.7	7.29.3	Lock-only minor; transpiler	#12560
css-loader	7.1.2	7.1.4	Lock-only patch; webpack plugin	#12561
diff	4.0.2	4.0.4	Patch; utility lib	#12563

All maintenance packages are dev/build tools not shipped to browsers. Risk: very low.

Testing

All packages installed in Docker and verified:

npm install  # clean resolution, all versions confirmed in lockfile
make js      # webpack compiled successfully
npm run svg-min  # all SVGs processed without error
npm run test:js

Jest results: 20 test suites, 388 tests passed, 0 failures.

HTTP check: App serves 200 on / and /search?q=test after JS rebuild.

Checklist

All packages install cleanly
JS bundle builds (make js)
SVG optimization runs (npm run svg-min)
App serves HTTP 200 after rebuild
388 Jest tests passing, 0 failures
CI passing

References

Closes #11795, #11641, #12010, #12305, #10975, #12447, #12200, #11126, #12560, #12561, #12563

Used via named method imports (debounce, chunk, orderBy, groupBy, uniq, uniqBy, fromPairs) — all stable 4.x APIs unchanged in this release.

…1641) Transitive dep via @ericblade/quagga2 override — not imported directly.

Fixes CVE-2026-29074 (DoS via entity expansion in DOCTYPE, billion laughs). API migration: extendDefaultPlugins() removed in v3. Replaced with preset-default plugin + overrides map in conf/svgo.config.js. Re-ran npm run svg-min with the new version; SVG output included. Verified: `make js` builds cleanly, svg-min processes all static SVGs.

…[SECURITY] Lockfile update covering all four security dep upgrades in this batch. Vite resolved to 8.0.5 (was 8.0.3) — lock-only bump, closes #12305.

Copilot

Pull request overview

This PR consolidates multiple JS security dependency upgrades (lodash, qs override, svgo, vite lock) and re-optimizes the repo’s SVG assets using the updated SVGO configuration.

Changes:

Bump lodash to 4.18.1, svgo to v4, and qs (override) to 6.14.1 in package.json.
Migrate SVGO config to SVGO v4’s preset-default + overrides structure.
Re-run SVG optimization across static/images/** (many SVG diffs).

Reviewed changes

Copilot reviewed 2 out of 56 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
static/images/twitter.svg	Re-optimized SVG output via SVGO v4
static/images/tweet.svg	Re-optimized SVG output via SVGO v4
static/images/search-icon.svg	Re-optimized SVG output via SVGO v4
static/images/pinterest.svg	Re-optimized SVG output via SVGO v4
static/images/openlibrary-icon.svg	Re-optimized SVG output via SVGO v4
static/images/onboarding/reading_goal.svg	Re-optimized SVG output via SVGO v4 (also removed attribution comment)
static/images/nav-arrow.svg	Re-optimized SVG output via SVGO v4
static/images/language-icon.svg	Re-optimized SVG output via SVGO v4
static/images/identifier_icons/wikidata.svg	Re-optimized SVG output via SVGO v4
static/images/identifier_icons/google_scholar.svg	Re-optimized SVG output via SVGO v4
static/images/icons/share.svg	Re-optimized SVG output via SVGO v4
static/images/icons/right-chevron.svg	Re-optimized SVG output via SVGO v4
static/images/icons/reviews.svg	Re-optimized SVG output via SVGO v4
static/images/icons/read aloud.svg	Re-optimized SVG output via SVGO v4
static/images/icons/open-book.svg	Re-optimized SVG output via SVGO v4
static/images/icons/octicon-link-external-24.svg	Re-optimized SVG output via SVGO v4
static/images/icons/notes.svg	Re-optimized SVG output via SVGO v4
static/images/icons/icon_slick-arrow-right.svg	Re-optimized SVG output via SVGO v4
static/images/icons/icon_search-inside.svg	Re-optimized SVG output via SVGO v4
static/images/icons/icon_eye-open.svg	Re-optimized SVG output via SVGO v4
static/images/icons/icon_eye-closed.svg	Re-optimized SVG output via SVGO v4
static/images/icons/icon_check-circle.svg	Re-optimized SVG output via SVGO v4
static/images/icons/down-chevron.svg	Re-optimized SVG output via SVGO v4
static/images/icons/barcode_scanner.svg	Re-optimized SVG output via SVGO v4
static/images/hamburger-icon.svg	Re-optimized SVG output via SVGO v4
static/images/github.svg	Re-optimized SVG output via SVGO v4
static/images/facebook.svg	Re-optimized SVG output via SVGO v4
static/images/categories/science_fiction.svg	Re-optimized SVG output via SVGO v4
static/images/categories/science.svg	Re-optimized SVG output via SVGO v4
static/images/categories/romance.svg	Re-optimized SVG output via SVGO v4
static/images/categories/religion.svg	Re-optimized SVG output via SVGO v4
static/images/categories/recipes.svg	Re-optimized SVG output via SVGO v4
static/images/categories/plays.svg	Re-optimized SVG output via SVGO v4
static/images/categories/painting-palette.svg	Re-optimized SVG output via SVGO v4
static/images/categories/mystery_and_detective_stories.svg	Re-optimized SVG output via SVGO v4
static/images/categories/mysteries.svg	Re-optimized SVG output via SVGO v4
static/images/categories/music.svg	Re-optimized SVG output via SVGO v4
static/images/categories/medicine.svg	Re-optimized SVG output via SVGO v4
static/images/categories/interview.svg	Re-optimized SVG output via SVGO v4
static/images/categories/history.svg	Re-optimized SVG output via SVGO v4
static/images/categories/fantasy.svg	Re-optimized SVG output via SVGO v4
static/images/categories/church.svg	Re-optimized SVG output via SVGO v4
static/images/categories/biographies.svg	Re-optimized SVG output via SVGO v4
static/images/categories/art.svg	Re-optimized SVG output via SVGO v4
static/images/bubble-loader.svg	Re-optimized SVG output via SVGO v4 (currently stripped to empty SVG)
static/images/bsky.svg	Re-optimized SVG output via SVGO v4
package.json	Dependency upgrades for lodash/svgo and qs override
conf/svgo.config.js	SVGO v4 config migration (`preset-default` + overrides)

+                    convertPathData: false,
+                    removeDesc: false,
+                    removeTitle: false,
+                    removeViewBox: false,


Patch bump. Used in BarcodeScanner via createWorker/createScheduler — stable 4.x APIs unchanged.

…12447, #12200, #11126) Lock-only patches already within existing caret ranges; bump the floor: - @vitejs/plugin-vue ^6.0.5 → ^6.0.6 (build tool) - @babel/eslint-parser ^7.24.7 → ^7.28.6 (dev/lint tool) - mini-css-extract-plugin ^2.9.2 → ^2.10.2 (webpack plugin)

…n-vue 6.0.6, @babel/eslint-parser 7.28.6, mini-css-extract 2.10.2)

…12560, #12561, #12563) Lock-only or patch bumps, all dev/build tools: - @babel/preset-env ^7.24.7 → ^7.29.3 (transpiler) - css-loader ^7.1.2 → ^7.1.4 (webpack plugin) - diff 4.0.2 → ^4.0.4 (utility, patch)

…loader 7.1.4, diff 4.0.4)

Absorbs renovate PR #12566 into the JS security consolidation rollup. Updated package.json override and ran npm install to update lock file. make js compiled successfully; HTTP 200 verified on Docker.

mekarpeles · 2026-05-03T23:33:23Z

Added form-data 4.0.4 → 4.0.5 (from #12566) to this rollup. npm install updated package-lock.json; make js compiled successfully; HTTP 200 confirmed on Docker. Closes #12566.

mekarpeles · 2026-05-03T23:49:13Z

Assigning myself as the reviewer for this PR (as it is a collection of PRs originally opened by renovatebot)

mekarpeles added 4 commits May 3, 2026 13:39

chore(deps): upgrade lodash 4.17.21 → 4.18.1 [SECURITY] (closes #11795)

8bb2d84

Used via named method imports (debounce, chunk, orderBy, groupBy, uniq, uniqBy, fromPairs) — all stable 4.x APIs unchanged in this release.

chore(deps): upgrade qs override 6.5.3 → 6.14.1 [SECURITY] (closes #1…

c58fe21

…1641) Transitive dep via @ericblade/quagga2 override — not imported directly.

chore(deps): update package-lock.json (lodash, qs, svgo, vite 8.0.5) …

ef08b68

…[SECURITY] Lockfile update covering all four security dep upgrades in this batch. Vite resolved to 8.0.5 (was 8.0.3) — lock-only bump, closes #12305.

Copilot AI review requested due to automatic review settings May 3, 2026 19:40

This was referenced May 3, 2026

Update dependency lodash to v4.18.1 [SECURITY] #11795

Closed

Update dependency qs to v6.14.1 [SECURITY] #11641

Closed

Update dependency svgo to v4 [SECURITY] #12010

Closed

Update dependency vite to v8.0.5 [SECURITY] #12305

Closed

Copilot started reviewing on behalf of mekarpeles May 3, 2026 19:41 View session

Copilot AI reviewed May 3, 2026

View reviewed changes

Comment thread conf/svgo.config.js

convertPathData: false,

removeDesc: false,

removeTitle: false,

removeViewBox: false,

mekarpeles added 3 commits May 3, 2026 13:58

chore(deps): upgrade tesseract.js 4.1.1 → 4.1.4 (closes #10975)

c992893

Patch bump. Used in BarcodeScanner via createWorker/createScheduler — stable 4.x APIs unchanged.

chore(deps): update package-lock.json (tesseract 4.1.4, @vitejs/plugi…

eae8d3a

…n-vue 6.0.6, @babel/eslint-parser 7.28.6, mini-css-extract 2.10.2)

mekarpeles changed the title ~~chore(deps): consolidate JS security dependency upgrades~~ chore(deps): consolidate JS dependency upgrades (security + maintenance) May 3, 2026

This was referenced May 3, 2026

Update dependency tesseract.js to v4.1.4 #10975

Closed

Update dependency @vitejs/plugin-vue to v6.0.6 #12447

Closed

Update dependency @babel/eslint-parser to v7.28.6 #12200

Closed

Update dependency mini-css-extract-plugin to v2.10.2 #11126

Closed

mekarpeles assigned RayBB May 3, 2026

github-project-automation Bot added this to Ray's Project May 3, 2026

github-project-automation Bot moved this to Waiting Review/Merge from Staff in Ray's Project May 3, 2026

mekarpeles added the Priority: 1 Do this week, receiving emails, time sensitive, . [managed] label May 3, 2026

mekarpeles added 2 commits May 3, 2026 14:46

chore(deps): update package-lock.json (@babel/preset-env 7.29.3, css-…

53c31d9

…loader 7.1.4, diff 4.0.4)

This was referenced May 3, 2026

Update dependency feedparser to v6.0.12 #12564

Closed

Update dependency @babel/preset-env to v7.29.3 #12560

Closed

Update dependency css-loader to v7.1.4 #12561

Closed

Update dependency diff to v4.0.4 #12563

Closed

chore(deps): bump form-data 4.0.4 → 4.0.5 (closes #12566)

1aa818a

Absorbs renovate PR #12566 into the JS security consolidation rollup. Updated package.json override and ran npm install to update lock file. make js compiled successfully; HTTP 200 verified on Docker.

mekarpeles mentioned this pull request May 3, 2026

Update dependency form-data to v4.0.5 #12566

Closed

1 task

mekarpeles assigned mekarpeles and unassigned RayBB May 3, 2026

mekarpeles merged commit c475ae8 into master May 4, 2026
8 checks passed

github-project-automation Bot moved this from Waiting Review/Merge from Staff to Done in Ray's Project May 4, 2026

mekarpeles deleted the deps/js-security-consolidation branch May 4, 2026 00:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): consolidate JS dependency upgrades (security + maintenance)#12559

chore(deps): consolidate JS dependency upgrades (security + maintenance)#12559
mekarpeles merged 10 commits into
masterfrom
deps/js-security-consolidation

mekarpeles commented May 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

mekarpeles commented May 3, 2026

Uh oh!

mekarpeles commented May 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mekarpeles commented May 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

🔴 Security upgrades

🔧 Maintenance upgrades

Testing

Checklist

References

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mekarpeles commented May 3, 2026

Uh oh!

mekarpeles commented May 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mekarpeles commented May 3, 2026 •

edited

Loading