Repository navigation
chore(deps-dev): bump @vuepress/plugin-sitemap from 2.0.0-rc.132 to 2.0.0-rc.137 - #164
dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Bumps [@vuepress/plugin-sitemap](https://github.com/vuepress/ecosystem/tree/HEAD/plugins/plugin-sitemap) from 2.0.0-rc.132 to 2.0.0-rc.137. - [Release notes](https://github.com/vuepress/ecosystem/releases) - [Commits](https://github.com/vuepress/ecosystem/commits/v2.0.0-rc.137/plugins/plugin-sitemap) --- updated-dependencies: - dependency-name: "@vuepress/plugin-sitemap" dependency-version: 2.0.0-rc.137 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
792a825 to
56de3b6
Compare
…, and the audit fixes that came with it (#173) Replaces dependabot #163 and #164, which bumped these two separately and each carried the same `@vuepress/helper` lockfile move, so they conflicted with each other and with #162 once that landed. One branch regenerates the lockfile once. `npm audit fix` on top clears every HIGH on the tree: undici to 7.30.1 (the patched release — #140 had moved it to 7.30.0, one short of the fix for GHSA-xjj6-f33q-929c), markdown-it to 14.3.3, vite to 8.3.5. Audit goes from 1 critical / 3 high / 1 moderate to 1 critical / 1 moderate. Verified by building the site: `npm run docs:build` renders all 237 pages and exits 0, both before and after the audit fix. The remaining critical and moderate are one root cause and are NOT addressed here: `monaco-editor@0.56.0` bundles `dompurify@3.4.8`, and the fix is `monaco-editor@0.57.0`, a semver-major bump. docs/.vuepress/config.ts carries measured numbers for Monaco's share of the single render-blocking stylesheet and says in as many words to re-measure before changing it, so that bump needs its own change rather than riding along in a lockfile refresh. Both advisories are `development` scope on a static site, so nothing shipped is affected.
|
Superseded by #173, which lands both bumps at |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Bumps @vuepress/plugin-sitemap from 2.0.0-rc.132 to 2.0.0-rc.137.
Release notes
Sourced from @vuepress/plugin-sitemap's releases.
Commits