Repository navigation
deps: Override transitive packages flagged by Dependabot - #2110
Closed
marcleblanc2 wants to merge 2 commits into
Closed
marcleblanc2 wants to merge 2 commits into
marcleblanc2 wants to merge 2 commits into
Conversation
Closes Dependabot alerts #314 (source-map-js), #316 and #307 (dompurify), #315 (katex), #306 and #305 (@grpc/grpc-js), #303 and #302 (brace-expansion), #282 and #281 (toml), #194 (uuid), and #27 (esbuild). None of these are direct dependencies, so pnpm.overrides pins the patched ranges. esbuild is only a peer of contentlayer2 and mdx-bundler, which overrides do not reach, so it becomes a devDependency instead. Two overrides cross a parent's declared range: katex ^0.18 (mermaid 11 declares ^0.16; only used for math in diagrams, which no page has) and toml ^4 (remark-mdx-frontmatter declares ^3; only used for +++ TOML frontmatter, which no page has). Amp-Thread-ID: https://ampcode.com/threads/T-01a17ac5-7379-71a7-997b-fc6a725d4672 Co-authored-by: Amp <[email protected]>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
This comment has been minimized.
This comment has been minimized.
Amp-Thread-ID: https://ampcode.com/threads/T-01a17ac5-7379-71a7-997b-fc6a725d4672 Co-authored-by: Amp <[email protected]>
Contributor
Author
|
Folding into #2109: bumping mermaid to 12 and refreshing the stale lockfile entries covers most of these without overrides. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
pnpm.overridesfor eight transitive packages andesbuildas a devDependency.Why
Closes 12 of the 24 open Dependabot alerts. None are direct dependencies; they come in under
contentlayer2,mermaid,eslint, andpostcss.esbuildis only a peer ofcontentlayer2andmdx-bundler(>=0.17/0.*), and overrides do not reach auto-installed peers, so it is a devDependency instead.Two overrides cross the parent's declared range, both in code paths no page uses:
katex^0.18:mermaid11 declares^0.16. Only used for math in diagrams. Bumpingmermaidto 12 (which declares^0.18) is the cleaner fix later and drops this override.toml^4:remark-mdx-frontmatterdeclares^3. Only used for+++TOML frontmatter; every page uses YAML.Not in this PR
@opentelemetry/propagator-jaeger,@opentelemetry/core): the fix is OTel SDK 2.x, andcontentlayer2→@effect-ts/otelpins 1.x with a different@opentelemetry/apipeer. That tracing only runs insidecontentlayer2 buildand never reads a request header. Dismiss as "vulnerable code is not actually used".sprintf-js), #312 (braces): withdrawn advisories with no patched version. Dismiss.nextandsharp: deps: Fix 20 Dependabot alerts (next, sharp, mermaid 12, transitive refresh) #2109.Test plan
pnpm install: no new peer warnings (thelucide-react/ React 19 one is pre-existing)pnpm run build: 1494 static pagespnpm run lint: 0 errors, same 8 pre-existing warnings asmainpnpm startand loaded/admin/architecturein headless Chrome: the Mermaid diagram renders with the newdompurifyandkatex