Bump daisyui from 4.12.23 to 5.6.14 - #525
Conversation
Bumps [daisyui](https://github.com/saadeghi/daisyui/tree/HEAD/packages/daisyui) from 4.12.23 to 5.6.14. - [Release notes](https://github.com/saadeghi/daisyui/releases) - [Changelog](https://github.com/saadeghi/daisyui/blob/master/CHANGELOG.md) - [Commits](https://github.com/saadeghi/daisyui/commits/v5.6.14/packages/daisyui) --- updated-dependencies: - dependency-name: daisyui dependency-version: 5.6.14 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
| "chart.js": "^4.5.1", | ||
| "chartkick": "^5.0.1", | ||
| "daisyui": "^4.12.23", | ||
| "daisyui": "^5.6.14", |
There was a problem hiding this comment.
Dependency 'daisyui' is specified as a caret range (^5.6.14) rather than an exact, pinned version with checksum; pin to an exact version (and add checksum/lockfile and disable install scripts) to satisfy strict dependency management.
Details
✨ AI Reasoning
The change updates the daisyui entry in package.json to use a semver caret range (^5.6.14). The repository still relies on a floating specifier instead of an exact pinned version or checksum, and the new major-version bump increases risk of unexpected changes during installs. The edit worsens dependency pinning discipline because it moves to a new major without adopting exact pins, checksum fields, or install-script restrictions. This directly conflicts with the project's enforced dependency-management rules requiring exact pins/checksums and disabled install scripts. Only the changed line was considered; other files (lockfiles, npm config) were not modified in this diff.
🔧 How do I fix it?
Include lockfiles in your repo and CI. Pin exact versions or SHAs in manifests. Enable checksum verification. Set ignore-scripts in npm or equivalent. Enforce a 72hr minimum package age policy to avoid newly published malicious packages.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
|
Superseded by #526. |
Bumps daisyui from 4.12.23 to 5.6.14.
Release notes
Sourced from daisyui's releases.
... (truncated)
Changelog
Sourced from daisyui's changelog.
... (truncated)
Commits
0a34b49chore(release): 5.6.14539a61cfix:tabs-borderline sizec816a51fix: disabled select style in fieldset. closes: #46046fd6ccbfix: prevent --join-* propagation to children of .join-item (#4615). closes: ...b338aadfix: show open collapse ::details-content when prefers-reduced-motion (#4613)d67ad73chore(release): 5.6.130958416fix: modal-start and modal-end RTLb2e85a7chore(release): 5.6.1276148f7fix: email input RTL style in join41f26f2chore(release): 5.6.11Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)