Repository navigation
chore(deps-dev): update dev tooling within current majors to clear 18 Dependabot alerts - #418
Merged
Merged
Conversation
…dabot alerts Lockfile-only. Moves vitest and @vitest/coverage-v8 to 4.1.12, vite to 7.3.7, rollup to 4.64.12, js-yaml to 4.3.2, ws to 8.22.0, flatted to 3.4.4, the nested picomatch 4.x copies to 4.0.7 and @humanfs/node to 0.16.8, plus the transitive dependencies those versions require. All are development-only and none ship in the image. package.json is unchanged; vite stays on 7.x. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kikootwo
changed the title
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Lockfile-only update of development tools, within their current major versions, to clear the 18 open Dependabot alerts.
package.jsonis unchanged, there are nooverrides, and none of the app's own runtime dependencies move.One updated package does reach the image:
@standard-schema/spec1.0.0 → 1.1.0, a types-only package inside the Prisma CLI tree (prisma → @prisma/config → effect). vitest 4.1 needs^1.1.0, and npm keeps one shared copy. The Prisma CLI tree in the image has the same 35 packages as onmain.Transitive moves that vitest 4.1 requires come along with it (chai, tinyrainbow, std-env, es-module-lexer, ast-v8-to-istanbul and a few more). Four of them are new majors, used only by the vitest family: std-env 3 → 4, es-module-lexer 1 → 2, ast-v8-to-istanbul 0.3 → 1.0 and a nested js-tokens 9 → 10. rollup now also lists its optional native
@napi-rs/lzmabinary (dev only; not in the image). The lockfile was written with npm 11, which matches the image's Node 24.Checks
npm audit: 23 findings before (2 top-severity, 15 high), 13 after (no top-severity, 9 high). None of the remaining 13 is one of the 18 alerts.npm ci && npx prisma generate && npm test: 3,866 passed, 5 skipped (same asmainat the time).tsc --noEmitis clean, and lint findings are identical tomain.mainmerged in: the full unit suite in the Node 24 test container passes (294 files, 3,883 passed, 5 skipped, the same asmain), and so do the image build and the smoke test.🤖 Generated with Claude Code