fix: patch picomatch and nanoid transitive vulns - #20
Merged
Conversation
Bundles four Dependabot bumps that each passed CI individually on next, into one PR so they ride the next → master release together: - espree 9 → 11.2.0 (runtime; AST parser — ES2022–2025 suites green) - eslint 9 → 10.8.1 (dev; lint only) - @eslint/json 0.13 → 2.0.1 (dev; lint only) - @mdn/browser-compat-data 6 → 8.0.10 (dev; feature-data) npm ci verified clean (npm 10-compatible lockfile), full suite green (17 files / 24 tests). Supersedes #15, #16, #17, #18. Note: the two pre-existing high-sev transitives (picomatch 2.3.1 via fast-glob, nanoid 3.3.16) are untouched here — separate concern.
cldmv-bot
Bot
added
the
type: dependencies
This was referenced Aug 9, 2026
Resolves the two pre-existing high-severity transitives on next: - picomatch 2.3.1 → 2.3.2 (via fast-glob → micromatch; runtime reach) fixes GHSA-3v7f-55p6-f55p (method injection) + GHSA-c2c7-rcm5-vvqj (ReDoS) - nanoid 3.3.16 → 3.3.18 (via vitest → vite → postcss; dev) fixes GHSA-2v37-7h3g-55p8 (zero-size infinite loop) Both in-range (lockfile-only, no package.json change), npm audit now clean (0 vulnerabilities), npm ci verified, full suite green (17/17). Folds in the intent of #9 (security transitive bumps): next already carries newer brace-expansion (5.0.9) / minimatch (10.2.6) than #9's targets and no js-yaml in-tree, so #9 is moot against next — its fixes ride this release rather than the hotfixes lane.
cldmv-bot
Bot
changed the title
Contributor
|
Auto-normalized PR title: rewrote PR title to match the highest-priority commit type (
If this isn't what you want, edit the title — the normalizer won't re-fire as long as the title stays conventional. |
Shinrai
changed the title
Wires format/format:check (prettier) and lint/lint:fix (eslint, JS+JSON) to .configs/ so the post-merge lint-format autofix (CLDMV/.github v4.21.0) has scripts to run when this merges into next. eslint ignores the intentional-error scan fixture tests/testfile.js and generated src/data; removed one dead unused var so lint is green. Repo-wide formatting drift is left intentionally for the autofix to apply and commit back on the post-merge push.
cldmv-bot
Bot
added
the
area: tests
cldmv-bot
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the outstanding
next-targeting dependency work into a single PR so it all rides thenext → masterrelease (#19) together, and wires the repo's lint/format scripts for the post-merge autofix.Dependency bumps (each was CI-green individually on
next)espreeeslint@eslint/json@mdn/browser-compat-dataSecurity (transitive, lockfile-only)
picomatchfast-glob→micromatch; runtime reach)nanoidvitest→vite→postcss; dev)npm auditnow reports 0 vulnerabilities.Lint/format wiring
Adds
format/format:check(prettier) +lint/lint:fix(eslint, JS+JSON) wired to.configs/, so the post-merge lint-format autofix (CLDMV/.github v4.21.0) has scripts to run when this merges intonext. eslint ignores the intentional-error scan fixturetests/testfile.jsand generatedsrc/data; one dead unused var was removed solintis green. Repo-wide formatting drift is intentionally left for the autofix to apply and commit back on the post-merge push.Validation
npm ciclean against the regenerated lockfile (npm-10 compatible).npm run lintgreen; PR CI green (Node 22 + lts/*, CodeQL); the Lint & Format job correctly skips on the feature PR.Supersedes / folds in
hotfixes): folded here.nextalready carries newerbrace-expansion(5.0.9) /minimatch(10.2.6) than build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates #9's targets and has nojs-yamlin-tree, so build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates #9 is moot againstnext— its intent ships via this release instead of the hotfixes lane.