Skip to content

chore: upgrade VitePress and pin patched transitive deps - #190

Merged
yanglbme merged 1 commit into
mainfrom
chore/upgrade-deps-fix-security
Aug 24, 2026
Merged

chore: upgrade VitePress and pin patched transitive deps#190
yanglbme merged 1 commit into
mainfrom
chore/upgrade-deps-fix-security

Conversation

@yanglbme

Copy link
Copy Markdown
Member

Summary

  • Upgrade VitePress 2.0.0-alpha.172.0.0-alpha.19 (Vite 8)
  • Pin vite 8.2.2, esbuild 0.28.2, postcss 8.5.26, nanoid 3.3.18 in pnpm-workspace.yaml
  • Raise Vite chunkSizeWarningLimit to 2000 for the lazy-loaded local search index (~1.9 MB)
  • Declare engines.node as ^20.19.0 || >=22.12.0

Test plan

  • pnpm docs:build
  • pnpm audit --registry https://registry.npmjs.org — 0 vulnerabilities

Made with Cursor

Bump VitePress to 2.0.0-alpha.19 with Vite 8, pin postcss/nanoid/esbuild,
and raise the local-search chunk warning limit for this large doc set.

Co-authored-by: Cursor <cursoragent@cursor.com>
Copilot AI lite review requested due to automatic review settings August 24, 2026 12:11
@yanglbme
yanglbme merged commit 97bf258 into main Aug 24, 2026
1 check passed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades the documentation toolchain (VitePress/Vite) and pins key transitive dependencies via pnpm overrides to address patched versions and reduce supply-chain drift, while also adjusting build settings and declared Node.js compatibility.

Changes:

  • Upgrade VitePress from 2.0.0-alpha.17 to 2.0.0-alpha.19 (bringing in Vite 8–related dependency updates via the lockfile).
  • Pin patched transitive deps (vite, esbuild, postcss, nanoid) using pnpm overrides and reflect them in the lockfile.
  • Add engines.node and raise Vite build chunkSizeWarningLimit for the docs build.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File Description
pnpm-workspace.yaml Adds/updates pnpm overrides to pin specific patched transitive dependency versions.
pnpm-lock.yaml Regenerates lockfile to reflect the VitePress upgrade and override-pinned dependency graph.
package.json Declares supported Node.js engine range and upgrades VitePress devDependency.
docs/.vitepress/config.mts Raises Vite build chunkSizeWarningLimit to reduce warnings for the large lazy-loaded search index chunk.
Files not reviewed (1)
  • pnpm-lock.yaml: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@yanglbme
yanglbme deleted the chore/upgrade-deps-fix-security branch August 24, 2026 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants