deps(template): bump vite 5→6.4.3 to clear dev-server advisories; add engines + workflow permissions - #5
Open
sanjeevkkansal wants to merge 1 commit into
Open
deps(template): bump vite 5→6.4.3 to clear dev-server advisories; add engines + workflow permissions#5sanjeevkkansal wants to merge 1 commit into
sanjeevkkansal wants to merge 1 commit into
Conversation
… engines + workflow permissions Bumps the template's vite devDependency from ^5.4.0 to ^6.4.3 (plugin-react ^4.3.0 already supports vite 6, no plugin change needed), which clears the three vite advisories plus the transitive esbuild one — 8 template advisories down to 4. The template still typechecks and builds; CI's npm-ci + gen-config + typecheck path is unchanged. The 4 remaining are deep-transitive dev/build-time deps — tmp (via solc), uuid and bigint-buffer (via @solana/web3.js). bigint-buffer has no published fix; forcing tmp/uuid majors risks breaking solc/web3.js, so those are left for their upstreams (Dependabot will pick them up). Also pins node engines (root >=18, template >=20) and adds `permissions: contents: read` to the ci workflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Reduces the template's dependency advisories from 8 → 4 and adds two small hardening touches. All remaining advisories are deep-transitive dev/build-time deps with no clean fix available in this repo (details below).
vite 5 → 6.4.3 (clears 4 advisories)
Bumps the template's
vitedevDependency^5.4.0 → ^6.4.3.@vitejs/plugin-react ^4.3.0already declares vite 6 support, so no plugin change is needed. This clears the threeviteadvisories (GHSA-fx2h-pf6j-xcff high, GHSA-v6wh-96g9-6wx3, GHSA-4w7w-66w2-5vf9) and the transitiveesbuildone (GHSA-67mh-4wv8-2f99, vite 6 pulls esbuild 0.25+; resolves to 0.28.1).Verified: template
npm ci+gen-config+typecheck+vite buildall pass; the CItemplate-configjob path is unchanged.Remaining 4 advisories — left deliberately
tmp(high + low) — transitive viasolc(contract compile, build-time only). Forcingtmp@0.2.xonto solc risks breaking compilation; left for solc to update.uuid(moderate) — transitive via@solana/web3.js. Forcinguuid@11creates a tree conflict withrpc-websockets(wants uuid 14) and risks web3.js at runtime.bigint-buffer(high) — transitive via@solana/web3.js; no published fix exists (GHSA-3gc7-fjrx-p6mg).With Dependabot security updates now enabled on the repo, these will be picked up automatically as solc / web3.js publish upgrades.
Hardening
engines.nodeadded: root>=18(scaffolder usescpSync), template>=20(vite 6).permissions: contents: readadded to the ci workflow.Note on the lockfile git URLs
The lockfile resolves the two
github:deps (@rome-protocol/registry,@rome-protocol/sdk) asgit+ssh://— this is npm's default normalization for thegithub:shorthand, not a misconfiguration, and it does not break installs:npm installandnpm ciboth fall back tohttpsautomatically (verified with ssh forced to fail), and both target repos are public. Left as-is.