Skip to content

chore(deps): remediate Dependabot alerts across examples#70

Merged
vladimir-tikhonov-nutrient merged 1 commit intomainfrom
chore/dependabot-security-remediation
Mar 4, 2026
Merged

chore(deps): remediate Dependabot alerts across examples#70
vladimir-tikhonov-nutrient merged 1 commit intomainfrom
chore/dependabot-security-remediation

Conversation

@vladimir-tikhonov-nutrient
Copy link
Contributor

Summary

  • Refresh lockfiles and dependency resolutions across npm, pnpm, and composer example projects to remediate Dependabot advisories with available patches.
  • Upgrade key direct dependencies where required (@angular/*, @sveltejs/kit, svelte, phpunit/phpunit, psy/psysh) and tighten overrides for rollup, minimatch, ajv, qs, and related transitive chains.
  • Keep example builds compatible by scoping Ajv overrides (to avoid Gatsby runtime breakage) and moving serve to ^13.0.4 in examples/pwa, examples/typescript, and examples/webpack.
  • Apply small Svelte/SvelteKit compatibility fixes required after security-related dependency updates (bind:this targets changed from const to let).
  • Remaining known gap: elliptic in examples/laravel/package-lock.json has no upstream patched version available yet (Dependabot first_patched_version: null).

Test plan

  • npm audit --json across all npm example projects for the targeted advisory packages (no remaining target advisories except the unresolved elliptic case).
  • pnpm audit --json in root, examples/svelte-kit, and examples/vue-composition-api (no remaining target advisories).
  • composer audit --locked --no-interaction in examples/laravel (no advisories).
  • Build verification for changed examples:
    • examples/angular: npm run build
    • examples/gatsbyjs: npm run build
    • examples/javascript-vite: npm run build
    • examples/nextjs: npm run build
    • examples/nuxtjs: npm run build
    • examples/pwa: npm run build
    • examples/react: npm run build
    • examples/svelte: npm run build
    • examples/typescript-vite: npm run build
    • examples/typescript: npm run build
    • examples/vite: npm run build
    • examples/vue: npm run build
    • examples/vue-composition-api: pnpm run build
    • examples/wasm-benchmark: npm run build
    • examples/webpack: npm run build

Refresh npm/pnpm/composer lockfiles and bump targeted dependency constraints so Dependabot advisories are fixed in example projects while preserving build compatibility.
@vladimir-tikhonov-nutrient vladimir-tikhonov-nutrient marked this pull request as ready for review March 2, 2026 13:35
Copy link
Contributor

@miguelcalderon miguelcalderon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@vladimir-tikhonov-nutrient vladimir-tikhonov-nutrient merged commit eb64423 into main Mar 4, 2026
3 checks passed
@vladimir-tikhonov-nutrient vladimir-tikhonov-nutrient deleted the chore/dependabot-security-remediation branch March 4, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants