fix(deps): resolve dependabot security alerts - #1933
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60ed1acfb5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Runs nanny update-package to pull dependency version bumps back into the src/packages fragments that own them, and manually syncs the overrides block (js-yaml, smol-toml) which nanny doesn't cover. Also removes a stale Hugo lint:templates wireit script that no longer has a matching binary, and adds twitter-text to tools/social-media.jsonc so it's no longer an untracked root dependency. Documents the package.json/src/packages relationship in AGENTS.md for future edits.
Fix genuine typos and American-English spellings found in prose, add a cspell ignoreRegExpList to stop YouTube/Unsplash ID fragments in frontmatter from being spell-checked, exclude gitignored Playwright test-log artifacts from linting, and add ~550 legitimate proper nouns, brand names, and technical terms to the custom dictionary. Closes #1931
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 498ca1a90b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The earlier fix-deps commits only added npm overrides to package.json and never ran npm install, so package-lock.json still resolved the vulnerable svgo/js-yaml/smol-toml/gray-matter versions despite the PR description claiming otherwise. Also syncs src/packages/site/astro.jsonc and src/packages/linting/markdownlint.jsonc so a future `nanny generate-package` run won't revert these overrides again. While auditing, also found and fixed a critical Astro RCE (GHSA-26w7-cxv4-gfx2, needs >=7.2.8) that isn't covered by any Dependabot alert yet, plus three moderate Hono advisories pulled in transitively via @humanwhocodes/crosspost -> @modelcontextprotocol/sdk. npm audit now reports 0 critical/high for all six packages touched here (svgo, js-yaml, smol-toml, gray-matter, astro, hono).
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Issac, hasslefree, and chromotography were typo corrections in this same branch (Isaac, hassle-free, chromatography) but had also been added to the dictionary allowlist, which would let the misspelling pass lint:spell silently if it ever recurred.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Fixed both review findings:
|
1 participant
Summary
npm audit fix(svgo → 4.1.0) plus newoverridespins for transitivejs-yamlandsmol-tomlversions used bygray-matterandmarkdownlint-cli2.honowas already pulled up to a patched version transitively by the svgo fix's lockfile refresh.Fixes
Test plan
npm installresolves cleanlynpm run test— 101 files / 448 tests passingnpx astro check— 0 errorsnpm audit— 0 Dependabot-tracked advisories remaining for these packages