fix: audit issues, renovate changes[KHCP-21019] - #882
Conversation
| "vue-router": "^4.6.4", | ||
| "vue-tsc": "^3.2.9" | ||
| }, | ||
| "pnpm": { |
There was a problem hiding this comment.
issue: we shouldn't be coupling the pnpm v11 upgrade with these other audit fixes. Please split up this PR
There was a problem hiding this comment.
yes, +1 , it will be much more convenient to track and specially rollback pnpm changes in separate pr.
There was a problem hiding this comment.
created a separate PR for pnpm migration - #890
sharmaadityaHQ
changed the title
adamdehaven
left a comment
adamdehaven
left a comment
There was a problem hiding this comment.
How are you confirming there are no issues from all of these changes?
I'm not sure I understand why all of this needs to go on one pull request
| "fast-uri@<=3.1.1": ">=3.1.2", | ||
| "uuid@<11.1.1": ">=11.1.1", | ||
| "vitest@<3.2.6": ">=3.2.6", | ||
| "brace-expansion@>=5.0.0 <5.0.6": ">=5.0.6", |
There was a problem hiding this comment.
There was previously something breaking across repos when adding brace expansion
There was a problem hiding this comment.
most of this was via pnpm audit --fix except the 3 changes listed in the PR description. i did 1-2 rounds of manual testing plus consuming PR in portal to check if CI is green there.
There was a problem hiding this comment.
any suggestions on a way we could be more confident that these changes don't break anything?
There was a problem hiding this comment.
I'm just concerned about the brace expansion upgrade but I can't remember what the issue was. Can we verify this works correctly in a portal preview?
There was a problem hiding this comment.
sure, i'll get back with an update here.
There was a problem hiding this comment.
it's always better to verify somewhere if unsure -- so creating a draft PR to consume the changes is an easy way to do so. If the draft PR passes and you functionally test in the host repo and things look ok, then you can report back and close the preview
There was a problem hiding this comment.
yes, already have the draft PR here - https://github.com/kong-konnect/portal/pull/2580. i'll also do a round of functional testing on a preview portal.
There was a problem hiding this comment.
i did a round of functional testing here - https://pr-2580-portal-ui-dev.konghq.workers.dev/apis/sensitive-data-masking-1/versions/65eb08cc-6e9e-44c1-9c41-ff1066a5aa47 via the consuming PR mentioned in the description of this PR. looks good.
This reverts commit a982df2.
## [1.107.18](v1.107.17...v1.107.18) (2026-07-03) ### Bug Fixes * audit issues, renovate changes[KHCP-21019] ([#882](#882)) ([ca20e24](ca20e24))
|
🎉 This PR is included in version 1.107.18 🎉 The release is available on: Your semantic-release bot 📦🚀 |
5 participants
Summary
This PR aims to fix all audit issues via
pnpm audit --fix, renovate PRs and some manual updates to avoid redundant overrides.rollup-plugin-visualizerfrom v6 to v7. verified by running thepnpm run build:analyzercommand. getting abundle-analyzer/stats-treemap.htmlfile in output.jsdomfrom v27 to v29. verified by running all tests.Consuming app PR - https://github.com/kong-konnect/portal/pull/2580
Jira - https://konghq.atlassian.net/browse/KHCP-21019