fix: resolve osv-scanner High/Medium advisories via patch-level dependency bumps - #846
Merged
Conversation
…dency bumps sca / osv-scanner fails on every PR since the advisories published (caught on #845, a docs-only PR): dompurify 3.4.12 (GHSA-55q2-fjhq-7xh7), js-yaml 4.3.0 (GHSA-5p4m-2wfm-xmqj), nanoid 3.3.16 (GHSA-2v37-7h3g-55p8), mermaid 11.16.0 (5 advisories). dompurify/nanoid/mermaid are lockfile-only bumps within range; js-yaml is exact-pinned in package.json so its manifest pin moves 4.3.0 -> 4.3.1. Same advisory set and fix shape as mif-docs-plugin#226 and claude-code-plugins#156 earlier today. Site builds clean (98 pages).
Contributor
There was a problem hiding this comment.
Pull request overview
This PR resolves newly published OSV-scanner High/Medium advisories by applying patch-level dependency bumps in the docs site’s npm dependency set, restoring sca / osv-scanner to green on PRs.
Changes:
- Bump
js-yamloverride from4.3.0to4.3.1inpackage.json. - Update
package-lock.jsonto pick up patched versions ofdompurify,nanoid,mermaid, andjs-yaml.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Moves the exact override pin for js-yaml to 4.3.1 to address the advisory. |
| package-lock.json | Updates resolved tarballs/integrity hashes to patched versions for the affected transitive dependencies. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
sca / osv-scannerfails on every PR since these advisories published — caught on #845 (a docs-only PR). Same advisory set and fix shape as mif-docs-plugin#226 and claude-code-plugins#156 earlier today:dompurify3.4.12 → 3.4.13 (GHSA-55q2-fjhq-7xh7) — lockfile-onlynanoid3.3.16 → 3.3.18 (GHSA-2v37-7h3g-55p8) — lockfile-onlymermaid11.16.0 → 11.16.1 (GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx, GHSA-c4c3-pg64-4m4v, GHSA-rhh3-jpg6-66xh) — lockfile-onlyjs-yaml4.3.0 → 4.3.1 (GHSA-5p4m-2wfm-xmqj) — exact-pinned inpackage.json, so the manifest pin moves tooSite builds clean against the bumped set (98 pages). Unblocks #845.