Repository navigation
chore(deps): move vitest and browserslist past their advisories - #322
Merged
Merged
Conversation
Dependabot alerts flagged four development-only packages in the frontend lock: vitest and @vitest/mocker (path traversal through the mocker's redirect mock, fixed in 4.1.11), baseline-browser-mapping (denial of service on invalid input, fixed in 2.11.0) and browserslist (uncaught crash on untrusted custom stats, fixed in 4.28.7). vitest and @vitest/coverage-v8 are raised to ^4.1.11 (which pulls the rest of the @vitest family to 4.1.11), and baseline-browser-mapping and browserslist are updated within their ranges to 2.11.26 and 4.29.2 with their data packages. Nineteen locked versions change in total, all in those families. The broader monthly refresh is deliberately not applied here: it moved 113 packages and broke a Markdown table browser test, so it needs its own look. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The lock was regenerated with npm 11 (Node 24), which drops the optional `@emnapi/runtime` entry; `npm ci` on npm 10 (Node 22, what CI runs) then refuses the lock with "Missing: @emnapi/runtime@1.11.3 from lock file". The entry is restored unchanged from main's lock. `npm ci --dry-run` now succeeds on both npm 10.9.2 and npm 11. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Dependabot reports four open advisories in
frontend/package-lock.json, all development-only:vitestand@vitest/mocker(path traversal / arbitrary file read through the mocker's redirect mock, fixed in 4.1.11),baseline-browser-mapping(denial of service on invalid input, fixed in 2.11.0) andbrowserslist(uncaught crash on untrusted custom stats, fixed in 4.28.7; the one rated high).Change
vitestand@vitest/coverage-v8are raised to^4.1.11, which moves the rest of the@vitestfamily to 4.1.11, andbaseline-browser-mappingandbrowserslistare updated within their ranges (2.11.26 and 4.29.2, with their data packages). 19 locked versions change, all in those families; nothing is added and one entry is removed.The monthly
Dependency refreshworkflow was run first (it works after #317) and opened a pull request that moved 113 packages. Its browser tests failed:getByRole('cell', { name: 'Aspect' })was not found in the Markdown table test, so one of the 113 changed behaviour. That pull request is not merged; this narrow one exists so the advisories are closed without it.Checks
npm ci, thennpm run typecheck,npm run lint: clean.npm test -- --run: 64 files, 835 tests passed on vitest 4.1.11.npm run build; CI runs both.Rollback
Revert the commit.
🤖 Generated with Claude Code