Skip to content

Fix dependency audit: bump vite and happy-dom #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
spearwolf wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix dependency audit: bump vite and happy-dom #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1cacbb5
Bump vite and happy-dom past high-severity advisories
spearwolf Nov 2, 2026
3052891
Document dependency advisory upgrades
Copilot Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ Top-level changes that are not tied to a single published package — build syst

The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

## 2026-11-02 — high-severity dependency advisories are addressed

- **`vite`** moves from `^7.3.6` to `^7.3.7` and **`happy-dom`** from `^20.11.2` to `^21.0.4`; the lockfile follows. These development dependency upgrades address the three high-severity advisories while keeping Vite on 7.x.

## 2026-10-12 — Weekly `pnpm audit` is green again

- **`overrides`** in `pnpm-workspace.yaml` raise `brace-expansion` to `^5.0.11` and `source-map-js`
Expand Down
76 changes: 38 additions & 38 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ packages:
# `SyntaxError: Invalid or unexpected token`. This override keeps every vite in
# the workspace on 7.x. Drop it once Oxc lowers decorators.
overrides:
vite: ^7.3.6
vite: ^7.3.7
# Floors that lift transitive dev dependencies past published advisories
# (`pnpm audit`, see .github/workflows/dependency-advisories.yml).
brace-expansion: ^5.0.11
Expand Down Expand Up @@ -59,7 +59,7 @@ catalog:
'@vitest/browser': 4.1.10
'@vitest/browser-playwright': 4.1.10
'@vitest/coverage-v8': 4.1.10
happy-dom: ^20.11.2
happy-dom: ^21.0.4
Comment thread
spearwolf marked this conversation as resolved.
Resolved
sinon: ^22.1.0
'@types/sinon': ^22.0.0
# Pinned exact: 4.3.4-fix.0 is a prerelease tag above 4.3.4, and a caret range
Expand All @@ -78,7 +78,7 @@ catalog:
'@playwright/test': ^1.62.1
playwright: ^1.62.1
# Held at 7.x on purpose — see the `overrides` block at the top of this file.
vite: ^7.3.6
vite: ^7.3.7

# --- lint/format ---
'@biomejs/biome': ^2.5.9
Expand Down