chore(deps): patch sharp and vite advisories via overrides - #60
Conversation
Follow-on to the transitive-advisory sweep. Both packages still resolved a vulnerable copy alongside a patched one, so the advisories stayed open: sharp 0.34.5 (< 0.35.0, high) beside 0.35.3, and vite 6.4.2 (<= 6.4.2, one high + one medium) beside 6.4.3. Pinning both to the already-present patched version collapses each to a single resolution and clears three more advisories. Same-major ranges, per the constraint documented on the existing overrides. Verified: build green, node 2/2, ruby 5/5.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 14 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR updates @aws-sdk/client-bedrock-runtime from version 3.745.0 to 3.759.0, with corresponding lockfile updates. The dependency update follows semantic versioning (minor version bump within v3) and appears to be a routine maintenance update.
No blocking issues identified. The changes are properly configured and the lockfile is correctly synchronized with the package.json update.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
1 participant
Follow-on to #58. Both packages still resolved a vulnerable copy alongside a patched one, so the advisories stayed open:
0.34.5+0.35.30.35.3only6.4.2+6.4.36.4.3onlyPinning each to the already-present patched version collapses it to a single resolution. Same-major ranges, per the constraint documented on the existing overrides.
Takes the repo from 20 → 17 open Dependabot advisories (started at 40).
The remaining 17 are all against
astroitself and require the 5.x → 7.x major upgrade — genuinely separate work with real migration risk, notably the zod v3/v4 coupling documented in #55.Verified: build green,
astro checkclean, node 2/2, ruby 5/5.