fix(deps): clear remaining transitive Dependabot alerts via overrides (2 critical + 7 high) - #113
Closed
catomean wants to merge 1 commit into
Closed
fix(deps): clear remaining transitive Dependabot alerts via overrides (2 critical + 7 high)#113catomean wants to merge 1 commit into
catomean wants to merge 1 commit into
Conversation
… (2 critical + 7 high) Transitive/dev-tooling only — no application code changes. Closes botsmann's remaining Dependabot tail (the highs/criticals #111 [Next 15] and #112 [protobufjs/ws] don't cover): - fast-xml-parser 5.3.4 → 5.10.1 (CRITICAL entity-encoding + highs) - handlebars 4.7.8 → 4.7.9 (CRITICAL template injection + highs) - flatted 3.3.3 → 3.4.3 (HIGH) - postcss → 8.5.10+ (direct dep bumped to ^8.5.10 + "$postcss" self-ref override to dedupe next's nested 8.4.31) - @babel/core, yaml (low/moderate) Multi-major packages use version-scoped override keys so each major line gets its own patched version (forcing one major onto the other's consumers would break the toolchain — e.g. minimatch 9 onto eslint's minimatch-3 API): - picomatch @2 → 2.3.2, @4 → 4.0.5 - minimatch @3 → 3.1.5, @9 → 9.0.9 - js-yaml @3 → 3.15.0, @4 → 4.3.0 Verified: npm audit clears all 9; `next build` green (81 pages); jest 227 passed / 0 failed (confirms the bumped jest/eslint toolchain works). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Collaborator
Author
|
Superseded by the consolidated security-overrides rebased onto Next 16 main. All transitive overrides (handlebars/fast-xml-parser/flatted/postcss/babel/yaml/picomatch/minimatch/js-yaml) plus NEW sharp ^0.35.3 are included. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Transitive / dev-tooling only — no application code changes. Closes botsmann's remaining Dependabot tail that #111 (Next 15) and #112 (protobufjs/ws) don't cover — including both remaining criticals.
fast-xml-parserhandlebarsflattedpostcss@babel/core,yamlpicomatchminimatchjs-yamlHow
overridesbumps.postcssis a direct dep, so a differing override rangeEOVERRIDEs — bumped the direct dep to^8.5.10and used a"$postcss"self-reference sonext's nested 8.4.31 dedupes onto it (single copy).picomatch2+4,minimatch3+9,js-yaml3+4) use version-scoped override keys ("picomatch@2","picomatch@4", …) so each major line gets its own patched version. Forcing a single version across majors would break the toolchain — e.g.minimatch9 has a different (ESM) API than theminimatch3 that ESLint 8 uses.Verification
npm audit— all 9 targets clearednext buildgreen — 81 static pagesjest— 227 passed / 0 failed (proves the bumped jest/eslint/babel toolchain still works)Together with #111 + #112, this closes botsmann's entire Dependabot security-alert tail. (Remaining Dependabot version-update PRs like next-16 are non-security majors, out of scope here.)
🤖 Generated with Claude Code