Skip to content

Fix dependency audit: bump vite and happy-dom - #13

Open
spearwolf wants to merge 2 commits into
mainfrom
fluffy-potato
Open

spearwolf wants to merge 2 commits into
mainfrom
fluffy-potato

Conversation

@spearwolf

Copy link
Copy Markdown
Owner

Fixes the failing dependency-advisories job (3 high advisories).

  • vite floor ^7.3.6 -> ^7.3.7 (stays on 7.x)
  • happy-dom ^20.11.2 -> ^21.0.4
  • lockfile regenerated; pnpm audit --audit-level=high now reports only moderate advisories

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings November 2, 2026 06:42

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The dependency upgrades and advisory remediation lack the dated root CHANGELOG.md entry required by the repository’s contribution guidelines.

1 open issue
1 file not reviewed
  • pnpm-lock.yaml: Generated file
What changed in this PR

Updates development dependencies to address the reported high-severity advisories while preserving the workspace’s Vite 7 compatibility requirement.

Changes:

  • Raises the Vite catalog and override floor from ^7.3.6 to ^7.3.7.
  • Upgrades happy-dom from ^20.11.2 to ^21.0.4.
  • Regenerates the lockfile with the updated versions and dependent references.
File Description
pnpm-workspace.yaml Updates the centralized Vite and happy-dom version ranges.
pnpm-lock.yaml Records the upgraded packages and updated dependency resolutions.

Review effort: Balanced

Comment thread pnpm-workspace.yaml Resolved
@spearwolf

Copy link
Copy Markdown
Owner Author

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

Co-authored-by: spearwolf <12805+spearwolf@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants