Repository navigation
Clear the Dependabot alerts: what's shipped, what's dev-only, and the plan #37
Description
GitHub listed 25 open Dependabot alerts on verifier-plugin when this was written. PR 1 has since fixed 4, and 7 new undici alerts arrived on 29 October, so 28 are open. All are labelled "development". That label comes from package.json, where verifier-core is a devDependency, but the plugin bundles verifier-core and its dependencies into dist/. So the real test is what's inside the built plugin (dist/THIRD_PARTY_LICENSES.md lists every bundled package).
In the shipped plugin (5 alerts)
| Package | Alerts | Fixed in | Where from | Plan |
|---|---|---|---|---|
fast-uri 3.1.8 |
2 low, 2 medium | 3.1.9 | verifier-core → ajv (allows ^3.0.1) |
PR 1 (#38), done |
@stablelib/ed25519 1.0.3 |
1 medium | no fix released | verifier-core's Ed25519Signature2020 path | upstream: digitalcredentials/verifier-core#84 |
Exposure for fast-uri looks low, and PR 1 (#38) tests it: ajv calls it only while compiling the Open Badges schemas bundled with verifier-core, on those schemas' own addresses, and checking a credential never calls it. A credential's web addresses are checked only as strings: none of the bundled schemas uses format: uri. (Corrected 29 October 2026: this used to say they were checked by a regular expression in ajv-formats.)
Development and CI only, not in the built plugin (27 alerts)
| Package | Alerts | Fixed in | Where from | Plan |
|---|---|---|---|---|
vite 8.3.0 |
6 | 8.3.3 | our devDependency (allows ^8.2.0) |
PR 2 |
vite 7.3.6 |
5 | 7.3.7 | inside Vitest 3 | PR 2 (and gone after PR 3) |
undici 6.28.1, 7.29.1 |
7 high, 2 medium (7 added 29 October) | 6.29.1, 7.30.1 | security-document-loader; verifier-core's Node HTTP client (browsers use fetch) |
PR 2 |
shell-quote 1.10.0 |
1 critical | 1.11.0 | react-devtools-core ← security-document-loader | PR 2 |
source-map-js 1.2.1 |
1 high | 1.2.2 | postcss ← vite | PR 2 |
tinypool 1.1.1 |
2 critical | 2.1.2 | Vitest 3 (allows only ^1) |
PR 3 |
vitest, @vitest/mocker |
3 medium | 4.1.12 | our devDependency | PR 3 |
Plan, one small PR each
- PR 1:
fast-uri3.1.9. The only change to shipped code; show the built plugin differs only infast-uri, and smoke-test the preview. Done in Move fast-uri to 3.1.9 #38; its 4 alerts closed on merge. - PR 2: patch updates within existing ranges (
vite, thevite7 copy,undici,shell-quote,source-map-js). Lockfile only;vitebuilds the plugin, so compare the built output before and after. - PR 3: Vitest 3 → 4 or later. A major upgrade of the test runner the consistency suite depends on (including its pause between tests and the nameless tests' 30 s limit): CI sampled several times, mutation checks that the safety nets still fail when they should.
- Upstream:
@stablelib/ed25519stays open until Ed25519Signature2020 path bundles @stablelib/ed25519 1.0.3 (GHSA-x3ff-w252-2g7j) verifier-core#84 is resolved.
After PRs 1 and 2, 6 alerts remain (all dev-only, plus @stablelib); after PR 3, only @stablelib.
The wallet and verifier-core have their own lockfiles; this issue covers verifier-plugin only. Nothing here reaches the wallet until its verifier-plugin pin is bumped.
Activity