Skip to content

deps(dashboard): settle the transitive advisory tail in one pass #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blitzcrieg1 merged 1 commit into from
Aug 22, 2026
+29 −102
Merged

deps(dashboard): settle the transitive advisory tail in one pass #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
120 changes: 21 additions & 99 deletions apps/dashboard/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 8 additions & 3 deletions apps/dashboard/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,16 +34,21 @@
"eslint": "^8",
"eslint-config-next": "15.5.21",
"jsdom": "^25.0.1",
"postcss": "^8",
"postcss": "^8.5.23",
"tailwindcss": "^3.4.17",
"typescript": "^5",
"vitest": "^4.1.11"
},
"overrides": {
"sharp": "^0.35.3"
"sharp": "^0.35.3",
"@hono/node-server": "^1.19.17",
"brace-expansion": "^5.0.9",
"fast-uri": "^3.1.5"
},
"overridesNote": {
"reason": "sharp is an optional transitive of next. Its only caller is the image optimizer, which next.config.js disables (images.unoptimized) and which cannot run in a static export anyway, so the libvips advisory is unreachable here. The override closes the alert without taking Next 16, which is what Dependabot's sharp PR actually proposed.",
"remove_when": "a 15.x depends on sharp >=0.35 itself, or the Next 16 migration is done on purpose"
"remove_when": "a 15.x depends on sharp >=0.35 itself, or the Next 16 migration is done on purpose",
"transitive_advisories": "@hono/node-server, brace-expansion and fast-uri are pinned forward here because each is a transitive dependency whose parent has not cut a release. Dependabot opened one PR per package and each invalidated the others' lockfile on merge, so they are done once, together. Remove an entry when its parent ships a version that satisfies the advisory on its own.",
"postcss_not_overridden": "next 15.5.21 pins postcss to exactly 8.4.31 and bundles it. Forcing a different version past a framework's exact pin is how a build breaks subtly, so that advisory stays open until the Next 16 migration. It is build-time tooling in a static export."
}
}
Loading