fix(deps): clear Dependabot dev-dep advisories (vite, js-yaml, esbuild) - #125
Merged
Conversation
Resolve all 4 open Dependabot alerts (all dev-scope; npm audit now clean): - vite 8.0.14 -> 8.0.16 GHSA-fx2h-pf6j-xcff (high), GHSA-v6wh-96g9-6wx3 (med) - js-yaml 4.1.1 -> 4.2.0 GHSA-h67p-54hq-rp68 (med) - esbuild dropped GHSA-g7r4-m6w7-qqqr (low) Versions are pinned to the OLDEST patched releases that satisfy a ~30-day supply-chain soak window. npm's defaults (vite 8.1.0, js-yaml 4.3.0) were too fresh at 4d / 1d; the chosen 8.0.16 (26d) and 4.2.0 (27d) are battle-tested. Pinned via exact devDependency declarations in the owning workspaces, NOT root `overrides`: overrides do not reify in this repo's npm 10 setup (read from the empty lockfile, never written) and silently mis-resolve siblings (an esbuild override pinned vite to 8.0.14 instead of 8.0.16). esbuild was only ever an unused optional peer of vite (the plugin builds with tsc; vite bundles via rolldown -- nothing imports esbuild). It drops out cleanly when vite hoists to a single root copy, clearing the advisory with no functional change. Confirmed by leaving it out: build + tests still pass. Verified: npm audit = 0; vite-plugin tsc build + 24/24 tests pass; every introduced version 26-32 days old; cross-platform lockfile entries intact (only esbuild's 27 entries removed); npm ci validates.
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears all 4 open Dependabot alerts (all dev-scope).
npm audit→ 0 vulnerabilities.8.0.14 → 8.0.16—server.fs.denybypass (GHSA-fx2h-pf6j-xcff)4.1.1 → 4.2.0— quadratic DoS in merge keys (GHSA-h67p-54hq-rp68)Version choices: 30-day supply-chain soak
Pinned to the oldest patched releases that satisfy a ~30-day soak window, not npm's freshest:
Incidental sub-deps that rode in with vite/rolldown are also soaked: rolldown 1.0.3 (31d),
@oxc-project/types0.133.0 (32d), tinyglobby 0.2.17 (28d). No unsoaked package was introduced.Why exact pins, not
overridesoverridesare broken in this repo's npm 10 setup: they never reify (npm reads them from the empty lockfile, notpackage.json) and they poison sibling resolution (with an esbuild override present, npm silently pinned vite to 8.0.14 instead of 8.0.16). So each version is pinned via an exactdevDependencyin the workspace that owns it:packages/vite-plugin:vite^8.0.0→8.0.16crates/mds-napi: addjs-yaml4.2.0(transitive via@napi-rs/cli)These are temporary soak-pins — relax to caret ranges once 8.1.0 / 4.3.0 cross 30 days.
On esbuild removal
esbuild was only ever an unused optional peer of vite (the plugin builds with
tsc; vite bundles via rolldown — nothing in the repo imports esbuild). When vite hoists to a single root copy, the unused peer isn't reinstalled and drops out, clearing #3 with zero functional change. (The bundler was already rolldown-based at 8.0.14 — this is not a bundler swap.)Verification
npm audit→ 0 vulnerabilities@mdscript/vite-pluginbuild (tsc) ✅ + tests 24/24 pass ✅@rolldown/binding-*,@rollup/rollup-*,lightningcss-*,@napi-rs/*,@rspack/binding-*unchanged);npm civalidatesoverrides; no mass dependency drift