Repository navigation
chore(deps): update vulnerable dependencies - #262
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
🟢 Approval recommended
Manifest and lockfile changes are consistent, no blocking issues were identified, and the PR reports passing typechecks, tests, and package builds.
0 open findings
What changed in this PR
Updates dependencies across Trapeze’s Project API, test tooling, and website dependency tree to address reported security vulnerabilities.
Changes:
- Raises xmldom to
^0.9.12, including the root override. - Raises Vitest to
^4.1.11in both tested packages. - Refreshes transitive dependencies and consolidates Vitest lockfile entries.
| File | Description |
|---|---|
packages/project/package.json |
Updates xmldom and Vitest requirements. |
packages/configure/package.json |
Updates Vitest requirement. |
package.json |
Updates the shared xmldom override. |
package-lock.json |
Records updated dependency resolutions. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates dependencies flagged by
npm audit. Findings drop from 67 to 49.@xmldom/xmldom^0.9.9→^0.9.12inpackages/projectand in the rootoverrides. Fixes the fragment injection, raw-text closing tag and processing-instruction ReDoS advisories.vitest^4.1.4→^4.1.11inpackages/configureandpackages/project. Fixes the vitest path traversal / file read advisory (affected 2.1.0 to 4.1.10).npm audit fixon the lockfile, without--force. Clears 14 more transitive findings under the Docusaurus website, including the critical ones inproxy-addrandshell-quote.Remaining findings
braces3.0.3 (and everything that depends on it): no fixed release exists.@docusaurus/*3.10.2, which is already the latest release:tinypool,sharp,serialize-javascript,postcss-selector-parser,sockjsand the cssnano chain. Website build-time only.uuid< 11.1.1 viaxcode3.0.1 (moderate):xcodehas no newer release and only callsuuid.v4(), which is not affected.Test plan
npm run typecheck: 3 successful.npm test: configure 30 files / 124 tests, project 22 files / 203 tests, all passing.npm run build --filter='@trapezedev/*': 2 successful.