chore(deps): bump dev dependencies and close undici/fast-uri advisories - #233
Merged
Merged
Conversation
Supersedes #230, whose lockfile no longer applied after #231 landed. Carries the same dev-group bumps (@types/node 26.1.2, prisma 7.9.1, turbo 2.10.7, postcss 8.5.25) and adds two override bumps on top, so the tree is resolved once instead of twice. Bumping the Prisma CLI is not optional here: #231 moved @prisma/client and @prisma/adapter-pg to 7.9.1, and Prisma requires the CLI to match. undici: GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5 and GHSA-v3r7-h72x-cjcm are all first patched in 6.28.0. It reaches us through discord.js, which pins the version exactly, so the existing <6.27.0 override is the only lever. fast-uri: GHSA-7p8r-x3mc-p8w7 lands on top of GHSA-4c8g-83qw-93j6 and flags everything below 3.1.5. Dev-only, via ajv, and still capped below 4 because that is the line ajv asks for. Both old copies are gone from the lockfile rather than merely duplicated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #230, whose lockfile stopped applying once #231 landed. Rather than rebase it and then regenerate the same lockfile a second time for the override changes, this does both in one pass.
Dev dependency bumps (same set as #230)
@types/nodeprismaturbopostcssThe Prisma CLI bump is required, not cosmetic: #231 moved
@prisma/clientand@prisma/adapter-pgto 7.9.1, and Prisma expects the CLI to track them.Security overrides
undici
<6.27.0to<6.28.0closes GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5 and GHSA-v3r7-h72x-cjcm, which share 6.28.0 as their first patched version. It is a runtime dependency of the bot via discord.js, which pins the version exactly, so the override is the only way to move it.fast-uri
<3.1.3to<3.1.5closes GHSA-7p8r-x3mc-p8w7, which stacks on the GHSA-4c8g-83qw-93j6 fix already in place and flags everything below 3.1.5. Dev-only, via ajv, and still capped below 4 to stay on the line ajv wants.Verified in the lockfile:
undici@6.28.0andfast-uri@3.1.5are the only copies left, the older ones are gone rather than duplicated. This clears all four open Dependabot alerts.