From 1cacbb5f236bac64fb86f799ca67aefa8a282a92 Mon Sep 17 00:00:00 2001 From: spearwolf <12805+spearwolf@users.noreply.github.com> Date: Mon, 2 Nov 2026 06:42:38 +0000 Subject: [PATCH 1/2] Bump vite and happy-dom past high-severity advisories Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- pnpm-lock.yaml | 76 ++++++++++++++++++++++----------------------- pnpm-workspace.yaml | 6 ++-- 2 files changed, 41 insertions(+), 41 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3670bba..92ce426 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -43,8 +43,8 @@ catalogs: specifier: ^0.1.1 version: 0.1.1 happy-dom: - specifier: ^20.11.2 - version: 20.11.2 + specifier: ^21.0.4 + version: 21.0.4 istanbul-lib-coverage: specifier: ^3.2.2 version: 3.2.2 @@ -80,7 +80,7 @@ catalogs: version: 4.1.10 overrides: - vite: ^7.3.6 + vite: ^7.3.7 brace-expansion: ^5.0.11 source-map-js: ^1.2.2 @@ -105,7 +105,7 @@ importers: version: 0.28.2 happy-dom: specifier: 'catalog:' - version: 20.11.2 + version: 21.0.4 istanbul-lib-coverage: specifier: 'catalog:' version: 3.2.2 @@ -129,7 +129,7 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + version: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) packages/shadow-objects: dependencies: @@ -169,8 +169,8 @@ importers: specifier: 'catalog:' version: 7.0.2 vite: - specifier: ^7.3.6 - version: 7.3.6(@types/node@24.13.3)(lightningcss@1.33.0) + specifier: ^7.3.7 + version: 7.3.7(@types/node@24.13.3)(lightningcss@1.33.0) packages/shadow-objects-testing: dependencies: @@ -192,10 +192,10 @@ importers: version: 22.0.0 '@vitest/browser': specifier: 'catalog:' - version: 4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) + version: 4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) '@vitest/browser-playwright': specifier: 'catalog:' - version: 4.1.10(playwright@1.62.1)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) + version: 4.1.10(playwright@1.62.1)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) '@vitest/coverage-v8': specifier: 'catalog:' version: 4.1.10(@vitest/browser@4.1.10)(vitest@4.1.10) @@ -207,7 +207,7 @@ importers: version: 22.1.0 vitest: specifier: 'catalog:' - version: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + version: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) packages/shae-offscreen-canvas: dependencies: @@ -226,7 +226,7 @@ importers: version: 4.1.10(@vitest/browser@4.1.10)(vitest@4.1.10) happy-dom: specifier: 'catalog:' - version: 20.11.2 + version: 21.0.4 lil-gui: specifier: 'catalog:' version: 0.21.0 @@ -234,11 +234,11 @@ importers: specifier: 'catalog:' version: 0.185.1 vite: - specifier: ^7.3.6 - version: 7.3.6(@types/node@24.13.3)(lightningcss@1.33.0) + specifier: ^7.3.7 + version: 7.3.7(@types/node@24.13.3)(lightningcss@1.33.0) vitest: specifier: 'catalog:' - version: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + version: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) packages: @@ -883,7 +883,7 @@ packages: resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==} peerDependencies: msw: ^2.4.9 - vite: ^7.3.6 + vite: ^7.3.7 peerDependenciesMeta: msw: optional: true @@ -1044,8 +1044,8 @@ packages: resolution: {integrity: sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==} engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0} - happy-dom@20.11.2: - resolution: {integrity: sha512-7MB+bJLkxu3SowAfBJbjW+c55kNz5tkR45gu2qzrxznezhLeN5YIlJbwUgSzlGc+qWoZ8Ykg71H5ezz69xixrw==} + happy-dom@21.0.4: + resolution: {integrity: sha512-tFm+GaLBgo6o0awHnvHaNoraVo27qJ+2tZEtZ+cIa08hXbeitrxAJajLI05hsUy/2/YTKcUjQYzHe5mCcraLBw==} engines: {node: '>=20.0.0'} has-flag@4.0.0: @@ -1407,8 +1407,8 @@ packages: undici-types@7.18.2: resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==} - vite@7.3.6: - resolution: {integrity: sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==} + vite@7.3.7: + resolution: {integrity: sha512-AHEzTORMbi7/7aXp7w7KZ5+DCUdSeLsJz0grY8xHpc9DHdYb0vQu6DqJfm2tOw3gDExNgPgnJTXxM6syYFHaCA==} engines: {node: ^20.19.0 || >=22.12.0} hasBin: true peerDependencies: @@ -1463,7 +1463,7 @@ packages: '@vitest/ui': 4.1.10 happy-dom: '*' jsdom: '*' - vite: ^7.3.6 + vite: ^7.3.7 peerDependenciesMeta: '@edge-runtime/vm': optional: true @@ -1876,29 +1876,29 @@ snapshots: '@typescript/typescript-win32-x64@7.0.2': optional: true - '@vitest/browser-playwright@4.1.10(playwright@1.62.1)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10)': + '@vitest/browser-playwright@4.1.10(playwright@1.62.1)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10)': dependencies: - '@vitest/browser': 4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) - '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + '@vitest/browser': 4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) + '@vitest/mocker': 4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) playwright: 1.62.1 tinyrainbow: 3.1.1 - vitest: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + vitest: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) transitivePeerDependencies: - bufferutil - msw - utf-8-validate - vite - '@vitest/browser@4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10)': + '@vitest/browser@4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10)': dependencies: '@blazediff/core': 1.9.1 - '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + '@vitest/mocker': 4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) '@vitest/utils': 4.1.10 magic-string: 0.30.21 pngjs: 7.0.0 sirv: 3.0.2 tinyrainbow: 3.1.1 - vitest: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + vitest: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) ws: 8.21.3 transitivePeerDependencies: - bufferutil @@ -1918,9 +1918,9 @@ snapshots: obug: 2.1.4 std-env: 4.2.0 tinyrainbow: 3.1.1 - vitest: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + vitest: 4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) optionalDependencies: - '@vitest/browser': 4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) + '@vitest/browser': 4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) '@vitest/expect@4.1.10': dependencies: @@ -1931,13 +1931,13 @@ snapshots: chai: 6.2.2 tinyrainbow: 3.1.1 - '@vitest/mocker@4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))': + '@vitest/mocker@4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))': dependencies: '@vitest/spy': 4.1.10 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: - vite: 7.3.6(@types/node@24.13.3)(lightningcss@1.33.0) + vite: 7.3.7(@types/node@24.13.3)(lightningcss@1.33.0) '@vitest/pretty-format@4.1.10': dependencies: @@ -2111,7 +2111,7 @@ snapshots: merge2: 1.4.1 slash: 4.0.0 - happy-dom@20.11.2: + happy-dom@21.0.4: dependencies: '@types/node': 24.13.3 '@types/whatwg-mimetype': 3.0.2 @@ -2461,7 +2461,7 @@ snapshots: undici-types@7.18.2: {} - vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0): + vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0): dependencies: esbuild: 0.28.2 fdir: 6.5.0(picomatch@4.0.5) @@ -2474,10 +2474,10 @@ snapshots: fsevents: 2.3.3 lightningcss: 1.33.0 - vitest@4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)): + vitest@4.1.10(@types/node@24.13.3)(@vitest/browser-playwright@4.1.10)(@vitest/coverage-v8@4.1.10)(happy-dom@21.0.4)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)): dependencies: '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0)) + '@vitest/mocker': 4.1.10(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0)) '@vitest/pretty-format': 4.1.10 '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -2494,13 +2494,13 @@ snapshots: tinyexec: 1.3.0 tinyglobby: 0.2.17 tinyrainbow: 3.1.1 - vite: 7.3.6(@types/node@24.13.3)(lightningcss@1.33.0) + vite: 7.3.7(@types/node@24.13.3)(lightningcss@1.33.0) why-is-node-running: 2.3.0 optionalDependencies: '@types/node': 24.13.3 - '@vitest/browser-playwright': 4.1.10(playwright@1.62.1)(vite@7.3.6(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) + '@vitest/browser-playwright': 4.1.10(playwright@1.62.1)(vite@7.3.7(@types/node@24.13.3)(lightningcss@1.33.0))(vitest@4.1.10) '@vitest/coverage-v8': 4.1.10(@vitest/browser@4.1.10)(vitest@4.1.10) - happy-dom: 20.11.2 + happy-dom: 21.0.4 transitivePeerDependencies: - msw diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 81a4414..b2a5544 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -10,7 +10,7 @@ packages: # `SyntaxError: Invalid or unexpected token`. This override keeps every vite in # the workspace on 7.x. Drop it once Oxc lowers decorators. overrides: - vite: ^7.3.6 + vite: ^7.3.7 # Floors that lift transitive dev dependencies past published advisories # (`pnpm audit`, see .github/workflows/dependency-advisories.yml). brace-expansion: ^5.0.11 @@ -59,7 +59,7 @@ catalog: '@vitest/browser': 4.1.10 '@vitest/browser-playwright': 4.1.10 '@vitest/coverage-v8': 4.1.10 - happy-dom: ^20.11.2 + happy-dom: ^21.0.4 sinon: ^22.1.0 '@types/sinon': ^22.0.0 # Pinned exact: 4.3.4-fix.0 is a prerelease tag above 4.3.4, and a caret range @@ -78,7 +78,7 @@ catalog: '@playwright/test': ^1.62.1 playwright: ^1.62.1 # Held at 7.x on purpose — see the `overrides` block at the top of this file. - vite: ^7.3.6 + vite: ^7.3.7 # --- lint/format --- '@biomejs/biome': ^2.5.9 From 30528917058f92982693956dca1ae4c1c31f79ba Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 2 Nov 2026 06:49:19 +0000 Subject: [PATCH 2/2] Document dependency advisory upgrades Co-authored-by: spearwolf <12805+spearwolf@users.noreply.github.com> --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d7a6146..d7d3ee0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ Top-level changes that are not tied to a single published package — build syst The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## 2026-11-02 — high-severity dependency advisories are addressed + +- **`vite`** moves from `^7.3.6` to `^7.3.7` and **`happy-dom`** from `^20.11.2` to `^21.0.4`; the lockfile follows. These development dependency upgrades address the three high-severity advisories while keeping Vite on 7.x. + ## 2026-10-12 — Weekly `pnpm audit` is green again - **`overrides`** in `pnpm-workspace.yaml` raise `brace-expansion` to `^5.0.11` and `source-map-js`