Skip to content

Chore: Update NPM dependencies#75

Open
imrraaj wants to merge 3 commits intodevelopfrom
chore/dependabot-issues
Open

Chore: Update NPM dependencies#75
imrraaj wants to merge 3 commits intodevelopfrom
chore/dependabot-issues

Conversation

@imrraaj
Copy link

@imrraaj imrraaj commented Mar 5, 2026

What

This PR adds overrides in package.json to address security vulnerabilities reported by Dependabot and npm audit.

Why

Fixes dependabot alerts

How

Testing Instructions

Screenshots

Additional Info

Checklist

  • I have read the Contribution Guidelines.
  • I have read the Development Guidelines.
  • My code is tested to the best of my abilities.
  • My code passes all lints (ESLint etc.).
  • My code has detailed inline documentation.
  • I have updated the project documentation as needed.

@imrraaj imrraaj self-assigned this Mar 5, 2026
Copilot AI review requested due to automatic review settings March 5, 2026 11:18
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the project’s Node/NPM dependency resolution to address security alerts and bumps the plugin version metadata accordingly.

Changes:

  • Add/extend package.json npm overrides to enforce patched transitive dependency versions.
  • Regenerate package-lock.json to reflect updated transitive dependency graph (e.g., minimatch/ajv/serialize-javascript updates).
  • Bump plugin version references to 1.1.2 across WordPress metadata files and changelog.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
readme.txt Bumps WordPress plugin “Stable tag” to 1.1.2.
package.json Adds new npm overrides entries to mitigate vulnerable transitive deps.
package-lock.json Locks updated transitive dependency versions corresponding to overrides.
oneaccess.php Bumps plugin header version and ONEACCESS_VERSION constant to 1.1.2.
CHANGELOG.md Adds 1.1.2 changelog entry for the dependency updates.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +79 to +89
"webpack-dev-server@<=5.2.0": ">=5.2.1",
"minimatch": ">=10.2.1",
"serialize-javascript": ">=7.0.3",
"@wp-playground/blueprints": {
"ajv": ">=8.18.0"
},
"@wp-playground/tools": {
"ajv": ">=8.18.0"
},
"@wp-playground/cli": {
"ajv": ">=8.18.0"
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new npm overrides entries use open-ended minimum ranges (e.g., minimatch: ">=10.2.1", serialize-javascript: ">=7.0.3", ajv: ">=8.18.0"). This can allow a future major release (or a release that bumps its required Node engine) to be pulled in on a fresh install, potentially breaking installs/builds despite the project’s own engine constraints. Prefer pinning overrides to a specific major (e.g., ^10.2.4 / ^7.0.4 / ^8.18.0) or an exact version so updates remain intentional and controlled.

Suggested change
"webpack-dev-server@<=5.2.0": ">=5.2.1",
"minimatch": ">=10.2.1",
"serialize-javascript": ">=7.0.3",
"@wp-playground/blueprints": {
"ajv": ">=8.18.0"
},
"@wp-playground/tools": {
"ajv": ">=8.18.0"
},
"@wp-playground/cli": {
"ajv": ">=8.18.0"
"webpack-dev-server@<=5.2.0": "^5.2.1",
"minimatch": "^10.2.1",
"serialize-javascript": "^7.0.3",
"@wp-playground/blueprints": {
"ajv": "^8.18.0"
},
"@wp-playground/tools": {
"ajv": "^8.18.0"
},
"@wp-playground/cli": {
"ajv": "^8.18.0"

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants