chore: relax 30-day soak pins for vite and js-yaml (deferred from #125) - #266
Open
dean0x wants to merge 1 commit into
Open
chore: relax 30-day soak pins for vite and js-yaml (deferred from #125)#266dean0x wants to merge 1 commit into
dean0x wants to merge 1 commit into
Conversation
PR #125 exact-pinned two devDeps to the oldest soaked patched versions while deferring newer releases that hadn't yet soaked. Both have now cleared the 30-day window (as of 2026-07-27): - vite 8.1.0 published 2026-06-23 (34 days) — relax from exact pin "8.0.16" to caret range "^8.1.0" in packages/vite-plugin/package.json - js-yaml 4.3.0 published 2026-06-26 (31 days) — @napi-rs/cli's own "^4.2.0" range now resolves to 4.3.0 on its own, so remove the manual devDep pin entirely from crates/mds-napi/package.json Also bumps two transitive security fixes in the lockfile (pre-existing vulns, not introduced by this PR): - js-yaml 4.2.0 → 4.3.0 (fixes GHSA advisory, 4.0.0–4.2.0 range) - fast-uri 3.1.2 → 3.1.4 (fixes GHSA-v2hh-gcrm-f6hx + GHSA-4c8g-83qw-93j6; security patch, soak rule waived per policy) Cross-platform optional binary count in package-lock.json: 108 (unchanged).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
PR #125 exact-pinned two devDeps to the oldest already-soaked patched versions while deferring newer releases that hadn't yet cleared the 30-day supply-chain soak window. As of 2026-07-27, both deferred versions have now soaked:
vite(packages/vite-plugin devDep)"8.0.16""^8.1.0"js-yaml(crates/mds-napi devDep)"4.2.0"(manual pin)vite: relaxed from an exact pin to the standard caret range
^8.1.0. Resolves to 8.1.5 in the lockfile.js-yaml:
@napi-rs/clialready declares"js-yaml": "^4.2.0"— with 4.3.0 now soaked (published 2026-06-26, 31 days), npm resolves to 4.3.0 on its own. The manual devDep that existed solely to hold the pin is removed entirely (preferred path per the deferred-bump plan).Bonus: pre-existing transitive security fixes
Three high-severity Dependabot alerts were already present on
mainbefore this PR. Two are resolved as a side-effect:ajv's^3.0.1range already allows 3.1.4; soak rule waived for security patches per policynpm auditnow reports 0 vulnerabilities.Cross-platform optional binary count in
package-lock.json: 108 entries — unchanged.Related issues
Closes the deferred-bump plan from #125.
Checklist
CHANGELOG.mdupdated under## [Unreleased](for user-facing changes) — devDep-only change, no user-facing impactcargo test --workspace,cargo fmt --all --check,cargo clippy --workspace --all-targets -- -D warnings— unaffected (Rust source unchanged)npm run build -w @mdscript/vite-pluginpasses (tsc);npm audit→ 0 vulnerabilitiesGenerated by Claude Code