Skip to content

fix: update vulnerable dependencies - #27

Merged
vivekanand1101 merged 1 commit into
mainfrom
fix/dependabot-security-alerts-20260803
Aug 3, 2026
Merged

fix: update vulnerable dependencies#27
vivekanand1101 merged 1 commit into
mainfrom
fix/dependabot-security-alerts-20260803

Conversation

@vivekanand1101

Copy link
Copy Markdown
Contributor

Summary

  • Update patched releases of Vite 6 and 7, Vitest, esbuild, PostCSS, Babel, Immutable, brace-expansion, js-yaml, fast-uri, ws, SVGO, and YAML.
  • Preserve each dependency's currently resolved major version.
  • Regenerate yarn.lock with patched transitive versions.

This addresses all 15 currently open Dependabot alerts without a major-version migration.

Verification

  • yarn install --frozen-lockfile --ignore-scripts
  • yarn build — passed
  • yarn lint — typecheck and ESLint passed
  • yarn test --run — Vitest reports that the repository currently contains no test files

Additional note

yarn audit still reports a pre-existing moderate AJV advisory under vite-plugin-dts/API Extractor. It is not one of the repository's current Dependabot alerts and its nested versions are not affected by selective Yarn resolutions without forcing incompatible dependency majors.

@vivekanand1101
vivekanand1101 merged commit a647ae9 into main Aug 3, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants