Skip to content

Pin NPM package dependecy versions + npm ci #290

Merged
davinotdavid merged 4 commits into
mainfrom
fix-vulnerabilities-jun-1-2026
Jun 1, 2026
Merged

Pin NPM package dependecy versions + npm ci #290
davinotdavid merged 4 commits into
mainfrom
fix-vulnerabilities-jun-1-2026

Conversation

@davinotdavid

@davinotdavid davinotdavid commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

What changed?

  • Pinned NPM package dependency versions according to what was being used in package-lock.json:

- vue from ^3.4.29 to 3.5.32
- vue-i18n from ^11.1.2 to 11.3.2
- storybook (+ addons) from ^10.1.x to 10.3.5
- vite from ^7.0.5 to 7.3.2
- vitest from ^4.0.3 to 4.1.3
- typescript from ~5.9 to 5.9.3
- @playwright/test from ^1.44.1 to 1.59.1
- eslint from ^9.15.0 to 9.39.4

  • Updated postcss from 8.5.9 to 8.5.15 due to security vulnerabilities
  • Updated GH Action workflows to use npm ci instead of npm i since we have a checked-in package-lock.json

Why?

We should have stable package versions!

Applicable Issues

Closes #289

@davinotdavid davinotdavid requested a review from devmount June 1, 2026 17:16

@devmount devmount left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good to me, Davi! Thanks for taking care of that!

However, I think it would be good to first merge #274 in and then pin the versions, since we had major version upgrades there 😇

@davinotdavid

Copy link
Copy Markdown
Contributor Author

Thanks for the review @devmount as we chatted in Matrix, I believe it would be a better isolation if we merge this in then cut a patch version then merge your PR in and cut a patch version. What do you think?

@davinotdavid davinotdavid requested a review from devmount June 1, 2026 20:16

@devmount devmount left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@davinotdavid Yes, let's do it like this! I take care of updating #274 when we tagged the next patch release

@davinotdavid davinotdavid merged commit a304162 into main Jun 1, 2026
3 checks passed
@davinotdavid davinotdavid deleted the fix-vulnerabilities-jun-1-2026 branch June 1, 2026 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pin package versions and use 'npm ci' instead

2 participants