This repository was archived by the owner on Aug 8, 2026. It is now read-only.
fix: resolve dependabot alerts and unblock renovate lock file maintenance - #1706
Merged
Conversation
…ance Runs npm audit fix to update dev-scope transitive dependencies (handlebars, js-yaml, shell-quote, picomatch, brace-expansion, flatted, @babel/core), resolving all 18 open Dependabot alerts. All fixes land within existing semver ranges, so package.json is unchanged. These alerts had built up because Renovate's lock file maintenance PR (#1655) could never automerge: stabilityDays applied to lockFileMaintenance too, and each weekly refresh reset its 3-day clock against freshly published releases. renovate.json now exempts lock file maintenance from the release-age gate, and migrates stabilityDays and depTypeList to their current names (minimumReleaseAge, matchDepTypes) and :masterIssue to :dependencyDashboard, per the Dependency Dashboard's config migration notice.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npm audit fixto update dev-scope transitive dependencies (handlebars,js-yaml,shell-quote,picomatch,brace-expansion,flatted,@babel/core), resolving all 18 open Dependabot alerts. Every fix lands within an existing semver range, sopackage.jsonis unchanged - onlypackage-lock.jsonmoved.renovate.jsonso this backlog doesn't rebuild. Renovate's Lock file maintenance PR #1655 has been open since 2025-11-24 and can never automerge:stabilityDays: 3applied to lock file maintenance too, and each weekly refresh pulled in freshly-published releases that reset the 3-day clock.lockFileMaintenance.minimumReleaseAgeis now set tonullto exempt it from that gate.renovate.json, migrates two other options the Dependency Dashboard (issue Dependency Dashboard #88) flagged as needing config migration:stabilityDays->minimumReleaseAge, anddepTypeList->matchDepTypes, plus:masterIssue->:dependencyDashboard(its current alias).Test plan
npm ci- reinstalls cleanly from the updated lockfilenpm audit- all 7 previously-alerted packages confirmed at patched versions; 0 low/moderate/critical vulnerabilities remain (a newly-published, unrelatedbrace-expansionadvisory, GHSA-mh99-v99m-4gvg, remains againsttest-exclude's bundled copy - fixing it requires--forceand downgradesjest-jasmine2to24.1.0, which is out of scope here; it isn't yet Dependabot-tracked for this repo either)npm run check:typesnpm run check:formatnpm run lintnpm run buildnpm run test:src/npm run test:cjs- same 3 pre-existingtest/cli.test.tsfailures as on unmodifiedmaster(expiredCHANGELOG_GITHUB_TOKENin this environment returns401 Bad credentials; confirmed by checking outmaster's lockfile and re-running - unrelated to this change)npx renovate-config-validator renovate.json- validates successfully🤖 Generated with Claude Code