Repository navigation
chore(deps): drop unused package-lock.json and refresh yarn.lock for security alerts - #464
Merged
Merged
Conversation
The project uses Yarn v1: CI (node.js.yml) runs yarn install/build/test with setup-node cache: yarn, the devcontainer and VS Code tasks invoke yarn, and the README documents yarn. package-lock.json was only kept in sync by Dependabot and caused duplicate security alerts. Ignore it to prevent accidental re-adds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
In-range transitive refreshes: - minimatch 3.1.2 -> 3.1.5, 9.0.5 -> 9.0.9 Yarn resolutions for transitive deps whose parents pin vulnerable ranges: - lodash 4.17.23 -> 4.18.1 (api-extractor, heft-jest-plugin pin ~4.17) - serialize-javascript 6.0.2 -> 7.1.2 (mocha 11, terser-webpack-plugin) - uuid 8.3.2 -> 11.1.1 (node-notifier) - validator 8.2.0/13.15.0 -> 13.15.35 (z-schema via node-core-library) No direct dependency versions changed. build, build:ci, test and pack pass on Node 20, 22 and 24. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears all 16 open Dependabot alerts (8 high, 8 medium).
1. Remove the unused
package-lock.json. This clears the 7 alerts filed against it. The project uses Yarn 1: CI (node.js.yml), the devcontainer, the VS Code tasks and the README all run yarn.package-lock.jsonwas added by a Copilot PR in May 2025 (aecbc2a), and since then only Dependabot has updated it. It's now listed in.gitignore.2. Refresh
yarn.lock. This clears the 9 alerts filed against it. No direct dependencies change.resolutions, needed where upstream packages pin ranges that exclude the fix:Validation
yarn install --frozen-lockfileon a cleannode_modules, thenyarn build:ci,yarn buildandyarn pack: all OK.yarn test: 6 passing on Node 20, 22 and 24, which is the CI matrix.Follow-up (not in this PR)
CI runs
yarn install --immutable. That's a Yarn Berry flag, and Yarn 1 on the runner doesn't honour it, so CI isn't actually enforcing the lockfile. The Yarn 1 equivalent is--frozen-lockfile.🤖 Generated with Claude Code