Skip to content

[Snyk] Security upgrade @supabase/supabase-js from 2.49.4 to 2.50.0 #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
KB01111 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade @supabase/supabase-js from 2.49.4 to 2.50.0 #13

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"@radix-ui/react-toast": "^1.2.11",
"@radix-ui/react-tooltip": "^1.1.8",
"@sentry/nextjs": "^9.14.0",
"@supabase/supabase-js": "^2.49.4",
"@supabase/supabase-js": "^2.50.0",
Copy link

@gemini-code-assist gemini-code-assist bot Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

While upgrading @supabase/supabase-js is correct, the pnpm-lock.yaml file has not been updated to reflect this change. This is a critical issue because it will cause builds to fail in environments that use a frozen lockfile (e.g., pnpm install --frozen-lockfile), as package.json and pnpm-lock.yaml will be out of sync. Please run pnpm install to generate the updated lockfile and commit it to this pull request to ensure the vulnerability is properly remediated across all environments.

"@tanstack/react-query": "^5.66.0",
Comment on lines 29 to 31
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Update pnpm lockfile for supabase upgrade

Changing @supabase/supabase-js to ^2.50.0 in package.json without regenerating frontend/pnpm-lock.yaml leaves the lockfile pinned to 2.49.4. Any CI or production install that runs pnpm install --frozen-lockfile will either fail due to the version mismatch or continue to resolve 2.49.4, meaning the security fix is not actually applied. Commit the updated lockfile so installs succeed and the vulnerability is remediated.

Useful? React with 👍 / 👎.

"@tanstack/react-query-devtools": "^5.66.0",
"@types/leaflet": "^1.9.16",
Expand Down