Take the development alerts off the list - #40
Merged
Conversation
happy-dom is the one alert on a package this repository declares itself, so it moves. ws travels with it, since that is where it came from. The rest arrive through vite, eslint and electron-builder, and every one of them already had a patched copy somewhere in the tree beside the old one. Resolutions collapse them. Where a package spans majors that cannot be merged, minimatch and brace-expansion and picomatch, the entries name the exact descriptor rather than forcing one version on every consumer. The versions chosen are the lowest that clear what the advisories name, so nothing crosses a major it was not already on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thirty alerts were open before this, and one of them is on a package this repository declares itself.
The direct one
happy-dommoves to a version past what its advisories name.wstravels with it: that is where it came from, and it has no entry of its own here.The rest
They arrive through vite, eslint and electron-builder. Every one of them already had a patched copy somewhere in the tree beside the vulnerable one, which is what makes a resolution the right tool rather than a version bump nobody controls:
Three packages span majors that cannot be merged, because a consumer of
minimatch@^3cannot take 10. Those entries name the exact descriptor:Every version chosen is the lowest that clears what the advisory names, so nothing crosses a major it was not already on.
What was run
Lint, typecheck, the unit tests, a full build, a packaged build, and the navigation and client RTU specs against the packaged app. That last part matters more than usual here:
js-yaml,@xmldom/xmldom,form-data,tmpandminimatchare electron-builder's own dependencies, so forcing them means the packer itself is under test.The full matrix runs on this branch.
What is left afterwards
uuid, the only alert with runtime scope. Its fix is a major version, and the bounds check it names is in v3, v5 and v6 with abufargument, while Modbux callsv4()without one. That one is a decision rather than a sweep.