Repository navigation
fix(deps): patch shell-quote, node-forge, undici, vite, fast-uri and happy-dom advisories - #32
Merged
Merged
Conversation
…happy-dom advisories
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches every critical and high advisory from
pnpm audit(before: 1 critical, 17 high, 19 moderate, 7 low; after: 0 critical, 0 high, 1 moderate, 1 low). All affected packages are dev/build-time only (web-ext, wxt, vitest, jsdom chains); nothing ships in the extension bundle.Transitive packages are pinned through
overridesinpnpm-workspace.yaml(pnpm 11).viteis a direct devDependency, so its range moves to^8.3.3(resolves to 8.3.5).Packages
undici@7(cheerio)undici@8(jsdom)^8.3.3Notes:
jsdom/nodeenvironments. With the override in place pnpm no longer installs it, so the advisories go away. The override stays so any future install gets ≥ 21.0.4.Not fixed (out of scope, low/moderate)
minimatch@3.1.5(moderate, GHSA-g3hv-75wg-m249): reached through eslint/addons-linter/web-ext. The fix is 11.0.1, a major jump from 3.x that those packages don't support.deepmerge@4.3.1(low, GHSA-gcqx-w48m-w2h4): from addons-linter. No patched release exists.Live GitHub compatibility failure (run 41311429023)
Not caused by dependencies, and not fixed here. Commit 58708b4 passed the same workflow on the 7 days before.
In the scheduled run, the unauthenticated GitHub REST API rate limit on the shared runner IP was used up (
x-ratelimit-limit: 60,x-ratelimit-remaining: 0). SoGET api.github.com/repos/mdn/learning-area/pulls/846returned 403. The extension could not resolve the PR's base side, so only the After iframe rendered. The test then timed out after 30s waiting for theBefore HTML preview for …number-game-errors.htmliframe, on all 3 attempts. Locally on this branch,pnpm run test:smokepasses 3/3.Possible follow-ups:
GITHUB_TOKEN, or skip/soft-fail when the rate limit is exhausted.Test results (local, Node 24, pnpm 11.28.3)
pnpm install --frozen-lockfile✅pnpm run compile✅pnpm test(build + vitest): 108/108 ✅pnpm run test:e2e: 26/26 ✅pnpm run zip+ archive smoke (--grep "blob preview embeds"): 1/1 ✅pnpm run test:smoke(live GitHub): 3/3 ✅pnpm audit: 0 critical, 0 high