chore(deps): Update Yarn dependencies (security-updates)

[nielsdrost7]

Yarn Dependency Update

This PR updates Yarn (npm) dependencies.

Update Type: security-updates
Triggered by: schedule

Lock File Status

✓ No lock file conflicts detected.

Updated Packages

╔═══════════════════════════════════════════════════════════════╗
║                    Package Update Report                     ║
╚═══════════════════════════════════════════════════════════════╝

📦 DIRECT DEPENDENCIES (from package.json)
─────────────────────────────────────────────────────────────────

  ✓ axios
    1.13.2 → 1.13.6


═════════════════════════════════════════════════════════════════
SUMMARY: 1 direct, 0 transitive (1 total)
═════════════════════════════════════════════════════════════════

Checks Performed

• Assets built successfully
• Dependencies installed and verified
• Lock file conflicts checked

Security Audit

2 security vulnerabilities detected. Please review audit-report.json.

Review Checklist

• Review updated packages and their changelogs
• Verify assets build correctly
• Check for breaking changes in frontend
• Test UI changes in development environment
• Verify no console errors in browser

---

This PR was automatically created by the Yarn Update workflow.

Summary by CodeRabbit

• Bug Fixes

  • Resolved high-severity Denial of Service vulnerability in axios that could cause service disruption
  • Resolved high-severity Arbitrary File Write vulnerability in Rollup via path traversal

• Chores

  • Updated axios dependency to address identified security issues
  • Enhanced audit reports with detailed vulnerability assessments and remediation guidance

[coderabbitai]

📝 Walkthrough

Walkthrough

Security audit records are updated with two high-severity vulnerability advisories for axios and vite>rollup. The axios dependency is bumped from ^1.13.2 to ^1.13.6 in package.json. A package update report file is reformatted to reflect package.json-based dependencies instead of composer.json.

Changes

Cohort / File(s)	Summary
Audit Data Updates audit-before.json, audit-report.json	Two new audit advisories added: axios (Denial of Service via proto in mergeConfig, v1.13.5+) and vite>rollup (Arbitrary File Write via Path Traversal, v4.59.0+). Both marked as high-severity vulnerabilities. Audit summary records 2 high-severity issues across 156 total dependencies.
Dependency Version Bump package.json	Axios devDependency constraint updated from ^1.13.2 to ^1.13.6 to address identified vulnerabilities.
Report Format Restructuring updated-packages.txt	Package update report reformatted from composer.json-based to package.json-based format. Shift from Filament/Laravel/PHPUnit dependencies to axios dependency tracking. Summary line added with decorative ASCII banner styling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰✨ Hop hop, the audits now are clear—
Two sneaky bugs we won't hold dear!
Axios strengthened, version's tight,
Package reports shine twice as bright! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main change: updating Yarn dependencies for security purposes, with axios being updated from 1.13.2 to 1.13.6 to address vulnerabilities.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch automated/yarn-update-21

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

package.json (1)

9-15: ⚠️ Potential issue | 🔴 Critical

High-severity Rollup vulnerability (CVE-2026-27606) remains unresolved.

The audit report confirms vite>rollup is at vulnerable version 4.54.0, which allows arbitrary file write via path traversal. While this PR updates Axios, it does not address the Rollup advisory documented in audit-report.json. The patched version is >=4.59.0. Either upgrade Vite to pull in a patched Rollup chain, or add a Yarn resolution to force rollup to ^4.59.0.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 9 - 15, The project still pulls vulnerable rollup
(CVE-2026-27606) via Vite; update package.json devDependencies to ensure rollup
>=4.59.0 either by bumping "vite" to a version that depends on rollup >=4.59.0
(upgrade the "vite" entry) or by adding a Yarn/NPM resolution that forces
"rollup": "^4.59.0" (add a "resolutions" or "overrides" entry). After changing
package.json, run the lockfile update (yarn install or npm install) and verify
with the audit report that rollup is now >=4.59.0.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@audit-before.json`:
- Around line 1-3: The file audit-before.json contains newline-delimited JSON
objects (lines starting with {"type":"auditAdvisory", ...} and
{"type":"auditSummary", ...}) but uses a .json extension causing JSON parsers to
fail; either rename the file to audit-before.ndjson to reflect NDJSON format or
convert the content into a single valid JSON array by wrapping the three
top-level objects (the entries with "type":"auditAdvisory" and
"type":"auditSummary") in [ ... ] and separating them with commas; update any
code or references that load audit-before.json to use the new filename or to
parse the file as an array instead.

---

Outside diff comments:
In `@package.json`:
- Around line 9-15: The project still pulls vulnerable rollup (CVE-2026-27606)
via Vite; update package.json devDependencies to ensure rollup >=4.59.0 either
by bumping "vite" to a version that depends on rollup >=4.59.0 (upgrade the
"vite" entry) or by adding a Yarn/NPM resolution that forces "rollup": "^4.59.0"
(add a "resolutions" or "overrides" entry). After changing package.json, run the
lockfile update (yarn install or npm install) and verify with the audit report
that rollup is now >=4.59.0.

---

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ba54801 and 7df00cc.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (4)

• audit-before.json
• audit-report.json
• package.json
• updated-packages.txt

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find audit-before.json
echo "=== Searching for audit-before.json ==="
find . -name "audit-before.json" -type f 2>/dev/null || echo "File not found in standard locations"

# Also check if it exists in current directory or common locations
if [ -f "audit-before.json" ]; then
  echo "Found: audit-before.json in current directory"
  echo "File size: $(wc -c < audit-before.json) bytes"
  echo "Line count: $(wc -l < audit-before.json)"
  echo ""
  echo "=== First 50 chars of each line ==="
  head -3 audit-before.json | cut -c1-50
fi

Repository: InvoicePlane/InvoicePlane-v2

Length of output: 404

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Test JSON validity
python3 - <<'PY'
import json
import glob
import os

print("=== Testing JSON validity ===")
paths = ["audit-before.json"]

for path in paths:
    if not os.path.exists(path):
        print(f"{path}: FILE NOT FOUND")
        continue
    
    try:
        with open(path, "r", encoding="utf-8") as f:
            json.load(f)
        print(f"{path}: ✓ Valid single JSON document")
    except json.JSONDecodeError as e:
        print(f"{path}: ✗ INVALID JSON (single document parse failed)")
        print(f"   Error: {e}")
    
    # Test as NDJSON
    print(f"\n{path}: Testing as NDJSON...")
    valid_lines = 0
    invalid_lines = 0
    try:
        with open(path, "r", encoding="utf-8") as f:
            for line_num, line in enumerate(f, 1):
                line = line.strip()
                if not line:
                    continue
                try:
                    json.loads(line)
                    valid_lines += 1
                except json.JSONDecodeError:
                    invalid_lines += 1
                    print(f"   Line {line_num}: Invalid JSON")
    except Exception as e:
        print(f"   Read error: {e}")
    
    print(f"   Valid JSON lines: {valid_lines}")
    print(f"   Invalid JSON lines: {invalid_lines}")
PY

Repository: InvoicePlane/InvoicePlane-v2

Length of output: 305

---

audit-before.json contains NDJSON (newline-delimited JSON) but uses a .json file extension, causing JSON parsers to fail.

The file contains three separate JSON objects on individual lines, not a single valid JSON document. This breaks parsers that expect the .json format. Rename the file to audit-before.ndjson or wrap the entries in a JSON array.

🧰 Tools

🪛 Biome (2.4.4)

[error] 2-2: End of file expected

(parse)

---

[error] 3-3: End of file expected

(parse)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@audit-before.json` around lines 1 - 3, The file audit-before.json contains
newline-delimited JSON objects (lines starting with {"type":"auditAdvisory",
...} and {"type":"auditSummary", ...}) but uses a .json extension causing JSON
parsers to fail; either rename the file to audit-before.ndjson to reflect NDJSON
format or convert the content into a single valid JSON array by wrapping the
three top-level objects (the entries with "type":"auditAdvisory" and
"type":"auditSummary") in [ ... ] and separating them with commas; update any
code or references that load audit-before.json to use the new filename or to
parse the file as an array instead.