Skip to content

bump dev dependencies to patched versions - #49

Merged
fabracht merged 1 commit into
mainfrom
security-dep-bumps
Oct 17, 2026
Merged

fabracht merged 1 commit into
mainfrom
security-dep-bumps

Conversation

@fabracht

Copy link
Copy Markdown
Contributor

Clears the 9 open Dependabot advisories. All are dev dependencies — nothing in the published dist/-only tarball is affected.

  • devDep floors: @vitest/{browser,browser-playwright,ui} + vitest ^4.1.10 → ^4.1.11, vue ^3.5.41 → ^3.5.42
  • overrides: add brace-expansion ^5.0.12, source-map-js ^1.2.2 (transitive-only leaves)

Resolves to vue 3.5.44, vitest 4.1.12, source-map-js 1.2.2, brace-expansion 5.0.12.

  • npm audit: 0 vulnerabilities (was 9)
  • npm run check: green, 36/36 tests on vitest 4.1.12

Applied via direct floor bumps + overrides + npm install because npm audit fix / npm update crash on an npm 10.9.4 arborist bug (edgesOut null).

@fabracht
fabracht merged commit 772831e into main Oct 17, 2026
4 checks passed
@fabracht
fabracht deleted the security-dep-bumps branch October 17, 2026 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant