Repository navigation
chore(deps): refresh vulnerable dependencies in the pnpm lockfile - #21
Open
Lur1N77777 wants to merge 1 commit into
Open
Lur1N77777 wants to merge 1 commit into
Lur1N77777 wants to merge 1 commit into
Conversation
Bundles the Dependabot updates that could not be merged individually: every Dependabot PR here rewrites pnpm-lock.yaml, so merging one made all the others conflict textually. Refreshed the affected packages once instead. Direct dependency: mysql2 ^3.16.0 -> ^3.24.5 (3.24.5 resolved) Transitive dependencies refreshed to the patched release already allowed by their parents' ranges: tar 7.5.x -> 7.5.22 shell-quote 1.8.3 -> 1.12.0 ws 8.22.0 / 7.5.13 / 6.2.6 js-yaml 4.3.2 / 3.15.2 fast-uri 3.1.8 nanoid 3.3.19 brace-expansion 5.0.12 / 2.1.7 / 1.1.21 undici 6.29.0 postcss 8.5.28 qs 6.16.0 browserslist 4.29.3 baseline-browser-mapping 2.11.27 postcss-selector-parser 6.1.4 body-parser 1.20.8 node-forge 1.4.0 http-cache-semantics 4.2.0 braces 3.0.3 postcss 8.5.28 `pnpm update` also moved a few direct dependencies to the newest release inside their existing caret ranges (@react-navigation/*, tailwindcss). Verified locally: - pnpm install --frozen-lockfile - pnpm check (tsc --noEmit) - pnpm test (117 passed, 1 skipped) - pnpm lint (0 errors) - pnpm build (esbuild server bundle) Still outstanding (need a major bump, deliberately not included): - vite 5.4.21 -> advisory fixed in 6.4.3 (transitive, tied to the Expo toolchain) - image-size -> 2.0.3 requires a major - uuid, decode-uri-component -> major bumps, transitive - vitest ^2.1.9 -> 3.2.6 / 4.1.11 requires a major (Dependabot PR #18 fails CI on vitest 4)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
CloudMail 有 14 个 Dependabot PR 积压，但由于它们都要改写同一个
pnpm-lock.yaml，合并任意一个都会让其余全部产生文本冲突（逐个处理需要十几轮 rebase）。所以这里把可安全更新的部分打包成一次刷新。
改动
直接依赖
mysql2^3.16.0→^3.24.5（解析为 3.24.5，修复 ≥3.23.1 的告警）传递依赖（均落在父包已声明的范围内）
tarshell-quotewsjs-yamlfast-urinanoidbrace-expansionundicipostcssqsbrowserslistbaseline-browser-mappingpostcss-selector-parser6.1.4、body-parser1.20.8、node-forge1.4.0、http-cache-semantics4.2.0、braces3.0.3同时
pnpm update会把少量直接依赖升到 caret 范围内最新版（@react-navigation/*、tailwindcss）。本地验证
pnpm install --frozen-lockfilepnpm check(tsc --noEmit)pnpm testpnpm lintpnpm build(esbuild)CI 还会跑 expo web export 与 Android release 编译，请在 CI 通过后再合并。
仍未处理（需要 major 升级，单独决策）
vite5.4.21 → 修复版 6.4.3（受 Expo 工具链约束）image-size→ 2.0.3 需要 majoruuid、decode-uri-component→ 传递依赖 majorvitest^2.1.9→ 需 3.2.6 / 4.1.11（Dependabot 的 PR build(deps-dev): bump vitest from 2.1.9 to 4.1.11 #18 升到 4.x 会让 CI 失败）