Repository navigation
chore(deps): 升级 vitest、fast-uri、serialize-javascript，补上 7 条依赖公告 - #629
Merged
Merged
Conversation
rainyflash
enabled auto-merge (squash)
October 28, 2026 06:28
都是开发和构建时才用的包： - vitest 和 @vitest/coverage-v8 4.1.11 → 4.1.12（@vitest/mocker 的两条）； - fast-uri 的覆盖从 3.1.8 提到 3.1.9（cdxgen、ajv 带进来的，四条）； - serialize-javascript 覆盖到 7.1.4（vite-plugin-pwa 经 workbox-build 带进来的，一条）。 deepmerge 那条上游还没有修复版本，先留着（低危，只在构建 Service Worker 时用）。 许可证清单跟着重新生成。 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rainyflash
force-pushed
the
chore/deps-security-2026-10-28
branch
from
October 28, 2026 06:51
56b4714 to
a6f7271
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
为什么
仓库开着 8 条依赖公告（4 条中危、4 条低危），都是开发和构建时才用的 npm 包。每天的依赖安全检查（
pnpm audit:node，只卡高危）没拦，但攒着不好。Dependabot 的 #579 只改了锁文件、没重新生成许可证清单，“格式、类型与测试”一直红，这个 PR 取代它。改了什么
vitest、@vitest/coverage-v8：4.1.11 → 4.1.12（@vitest/mocker的两条）。fast-uri的覆盖：3.1.8 → 3.1.9（@cyclonedx/cdxgen、ajv带进来的四条）。serialize-javascript的覆盖到 7.1.4（vite-plugin-pwa→workbox-build→@rollup/plugin-terser带进来的一条）。写法照pnpm.overrides里已有的几条。python tools/license_inventory.py generate）。deepmerge（workbox-build→@rollup/plugin-node-resolve）那条低危上游还没有修复版本，先留着：只在构建 Service Worker 时合并配置用，不碰外来输入。怎么查的
pnpm why确认三个包都解析到了修复版本。pnpm audit:node：只剩 deepmerge 那 1 条低危。license_inventory.py check通过；根配置的 vitest 全过（219 个文件、1249 条；在 feat(telemetry): 按粗地区汇总活跃账户和快慢，隐私说明页照实改 #625、fix(session): “最近登录过”过了 5 分钟就改成没有，服务器拒过一次也不再让人白填 #627 之后的 main 上重新做了一遍）；prettier通过。🤖 Generated with Claude Code