Repository navigation
Fix high-severity dependency vulnerabilities - #112
Merged
Merged
Conversation
ritz078
approved these changes
Oct 26, 2026
Resolve lockfile conflicts with the Web SDK 1.24.0 update by keeping the newer version of each dependency from either side: main's lockfiles for vue and the Vite examples, the PR's ip-address in angular, and main's svelte-kit lockfile plus the PR's newer nanoid and postcss. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates Vite and
follow-redirectsacross the examples to address the high-severity dependency alerts, then refreshes compatible security fixes in 11 example lockfiles. SDK versions and application source stay unchanged. No framework migration or new cooldown exception is included.The October 26 refresh removes 43 package audit findings, including 17 high-severity findings, compared with Friday’s PR head. Across the 11 changed examples, findings fall from 139 to 96. These are affected-package counts, not distinct vulnerabilities; remaining advisories are not all resolved by this PR. An automatic SvelteKit 3 upgrade was excluded because it requires a configuration migration.
Validation
The refresh did not run viewer smoke tests for Gatsby, Laravel, or Webpack, or cross-platform native-loading tests. The Playwright CI job remains pinned to Ubuntu 24.04 for compatibility with Playwright 1.56.1.