Skip to content

🧹 Resolve Security Vulnerabilities and Migrate Paraglide to v2#25

Open
MFA-X-AI wants to merge 5 commits intomainfrom
fahreza/package-updates
Open

🧹 Resolve Security Vulnerabilities and Migrate Paraglide to v2#25
MFA-X-AI wants to merge 5 commits intomainfrom
fahreza/package-updates

Conversation

@MFA-X-AI
Copy link
Member

@MFA-X-AI MFA-X-AI commented Feb 18, 2026

Noticed some security warnings in our package audit and realized they were tied to a few libraries that hadn't been updated in a while. Since one of the main culprits was actually deprecated, I attempted to clean up the stack. I also took the opportunity to fix a breaking issue in our CI pipeline related to pyAV dependency builds.

The stuff this PR did:

  • Cleaned up the audit: I cleared out the current warnings. Most were fixed with standard updates (Vite, Vitest), but I added two small overrides for ajv and cookie since those nested versions are currently stuck upstream.
  • Migrated Paraglide: The high-severity risks were coming from the old @inlang/paraglide-sveltekit. I updated it with the now recommended paraglide-js (v2).
  • Simplified the architecture: I was able to delete the old <ParaglideJS> layout wrapper and the i18n.ts file. It's now using the newer middleware and native SvelteKit reroute hooks.
  • Fixed CI Pipeline Dependency Builds: The GitHub Actions workflow was failing because the av package was attempting to compile from source against an incompatible version of FFmpeg in the ubuntu-latest runner. I added an apt-get install -y ffmpeg step to provide the base system media libraries, and added an av!=14.4.0 constraint to pyproject.toml. This forces uv to download a pre-compiled wheel instead, which bypasses the C-compiler entirely, turns the pipeline green.

The project is now passing pnpm audit and the test suite is running successfully.

@MFA-X-AI MFA-X-AI marked this pull request as ready for review February 19, 2026 05:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant