Skip to content

chore(deps-dev): update dependency @hey-api/openapi-ts to v0.97.3 [security] - autoclosed #1137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
renovate wants to merge 1 commit into from
Closed

chore(deps-dev): update dependency @hey-api/openapi-ts to v0.97.3 [security] - autoclosed #1137

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@
"devDependencies": {
"@arethetypeswrong/cli": "0.18.5",
"@faker-js/faker": "^10.6.0",
"@hey-api/openapi-ts": "0.95.0",
"@hey-api/openapi-ts": "0.97.3",

@cursor cursor Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Client codegen not regenerated

Medium Severity

This change only bumps @hey-api/openapi-ts to 0.97.3; it does not regenerate src/client. The shipped buildClientParams in params.gen.ts still assigns extra $query_ / similar keys without blocking __proto__, so the CVE-2026-48819 fix is not in the built client until npm run openapi-ts is run and committed.

Fix in Cursor Fix in Web

Triggered by project rule: Code Review Guidelines

Reviewed by Cursor Bugbot for commit 1196698. Configure here.

@cursor cursor Bot Sep 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generator now requires Node 22

Low Severity

@hey-api/openapi-ts 0.97.3 (via the 0.96.0 breaking change) requires Node >=22.13.0, but this package still declares engines.node as >=20 and documents Node 20 as the minimum. npm run openapi-ts can fail for developers on the currently supported Node 20 toolchain.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 17328b9. Configure here.

@cursor cursor Bot Sep 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lockfile out of sync with package.json

High Severity

package.json pins @hey-api/openapi-ts to 0.97.3, but package-lock.json still resolves 0.95.0. PR and main CI both run npm ci, which fails when those files disagree, so this bump cannot install or land.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 08cf487. Configure here.

"@testing-library/jest-dom": "7.0.1",
"@testing-library/react": "16.3.3",
"@testing-library/user-event": "14.6.7",
Expand Down
Loading