Repository navigation
chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in the dev-dependencies group across 1 directory - #29
Closed
dependabot[bot] wants to merge 7 commits into
Closed
dependabot[bot] wants to merge 7 commits into
dependabot[bot] wants to merge 7 commits into
Conversation
Private vulnerability reporting is now enabled on the repository, so there is a non-public channel to point reporters at. Without one, the only route was a public issue, which is itself the disclosure. The scope section draws the line at markup the attacker already controls: the library reflects the DOM it is handed, so an author- supplied <option> is not a finding on its own. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
main had no checks at all — the only workflow was the tag-triggered release, so nothing verified a change before it landed. This is also the status check the branch protection requires. npm test is deliberately not wired: it points at a test/test.js that does not exist (#8), so it would fail every run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Clears GHSA-2883-xcg3-v3hh, GHSA-w27v-7q3p-w38r and GHSA-4vpr-x523-8j87. Both are transitive devDependencies — js-yaml under eslint, svgo under rollup-plugin-postcss — so nothing here reaches the published dist/. Lockfile only: both land inside the existing semver ranges, so npm audit fix resolves them without --force and package.json is untouched. The svgo advisories concern removeScripts sanitising SVG. The stylesheet only references icon paths and carries no inline SVG, so postcss-svgo has nothing to process in this build either way. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Last open point of #4: contents: write applied to the whole job, so the publish step and both third-party actions ran with it. Actions has no step-level permissions, so the split is the only way to scope it. npm publish now runs with contents: read + id-token: write and no third-party actions beside it; release creation gets contents: write but installs no dependencies. The OIDC credential and the repo write token no longer share a job. The filename stays as is — npm's trusted publisher config pins the workflow filename, and renaming it would break publishing at the next tag. Job names are not part of that config. Refs #4 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…#27) Supersedes the three separate Dependabot PRs (#13, #15, #20). Doing them in one commit avoids each rebasing onto the others, since all three touch the same workflow file. - actions/checkout 4.4.0 -> 7.0.1 - actions/setup-node 4.4.0 -> 7.0.0 - mikepenz/release-changelog-builder-action 4.2.2 -> 6.3.0 The majors are runtime bumps (node24) plus, for checkout v7, a guard against checking out fork PRs on pull_request_target and workflow_run — triggers this repo does not use. setup-node v6 narrowed automatic caching to npm, which ci.yml already requests explicitly. The changelog builder's v5 breaking changes are in regex transformers, which this configuration does not set. commitMode is deprecated there in favour of mode: COMMIT but still supported, so the config is left alone. Each SHA was verified against the upstream tag rather than taken from the Dependabot diff. Refs #13, #15, #20 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Replaces Dependabot's grouped PR (#22), which did not install: it moved typescript to ^7.0.2 while leaving typescript-eslint at ^8.67.0, whose peer range is >=4.8.4 <6.1.0. That is not a grouping mistake — 8.70.0 is the latest typescript-eslint and no release supports TypeScript 7 yet, so 6.0.3 is as far as this can go today. TypeScript 6 surfaced two pre-existing problems in tsconfig.json that would otherwise have shipped broken type declarations: - rootDirs (plural, for virtual source roots) was doing nothing useful. Without an explicit rootDir, TS 6 emits declarations to dist/src/** and produces no dist/index.d.ts at all, so the "types" entry in package.json would point at a missing file. - moduleResolution: node (node10) is deprecated in 6 and stops working in 7. Under bundler resolution TypeScript checks the side-effect SCSS import, hence the ambient declaration in src/scss.d.ts. Also picks up the in-range updates for autoprefixer, globals, rollup, sass and typescript-eslint. Verified: eslint, tsc --noEmit and rollup all clean, and dist/ is byte-identical to the published 0.1.5 tarball. Refs #9, #22 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Bumps the dev-dependencies group with 1 update in the / directory: [typescript](https://github.com/microsoft/TypeScript). Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Collaborator
|
Closing to drop the branch, which was cut from a commit range that has since been rewritten on Note the underlying conflict is unchanged: |
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
TimG1804
deleted the
dependabot/npm_and_yarn/dev-dependencies-b7ceb5d816
branch
September 18, 2026 12:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the dev-dependencies group with 1 update in the / directory: typescript.
Updates
typescriptfrom 6.0.3 to 7.0.2Release notes
Sourced from typescript's releases.
Commits
1e4744dMerge branch 'main' into ts7-releasea5a219cmicrosoft/typescript-go#4558ecfe30dUpdate status localization5de25b5Hide executable name in TypeScript statusd7ce74aShow bundled TypeScript version for packaged servers29be66aCorrect TS 7 release version to 7.0.2ed2bd1bMerge branch 'main' into ts7-release8873075Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...9427131Set up stable / nightly extension split, other prep (microsoft/typescript-go#...d4eaca5microsoft/typescript-go#4549Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions