fix: resolve open dependabot security alerts#974
fix: resolve open dependabot security alerts#974jonathannorris wants to merge 4 commits intomainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
Resolves Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies using Yarn resolutions.
Changes:
- Add Yarn
resolutionsto pindompurifyto3.4.0andfollow-redirectsto1.16.0. - Regenerate
yarn.lockto reflect the new resolved versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Adds/updates resolutions entries to force patched dependency versions. |
| yarn.lock | Updates locked versions/checksums for dompurify and follow-redirects based on the new resolutions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Deploying devcycle-docs with
|
| Latest commit: |
940fab5
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://baf1ef9d.devcycle-docs.pages.dev |
| Branch Preview URL: | https://fix-dependabot-alerts-c2en.devcycle-docs.pages.dev |
Match the version range style used by parent packages per dependency resolution best practices.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "dompurify": "3.4.0", | ||
| "follow-redirects": "1.16.0", | ||
| "uuid": "^14.0.0" |
There was a problem hiding this comment.
The PR description says only dompurify and follow-redirects are being pinned to resolve 3 Dependabot alerts, but this change also forces uuid to ^14.0.0 via resolutions (a major-version jump from the previously locked 8.3.2). That can be breaking for transitive consumers (e.g., sockjs in the current lockfile depends on uuid@^8.3.2). Please either remove this override or document/justify it and pin to the minimal non-vulnerable version that is compatible with downstream constraints.
Summary
Resolved 3 open Dependabot security alerts by bumping vulnerable transitive dependencies via yarn resolutions.
Dependabot Alerts Resolved
dompurifydompurifyfollow-redirects