chore(deps): patch browserslist, baseline-browser-mapping, vitest - #96
Merged
Merged
Conversation
… advisories Clear four Dependabot alerts in the web dashboard's build and test toolchain: browserslist and baseline-browser-mapping come in through the PostCSS/autoprefixer/Vite chain, vitest and its transitive @vitest/mocker are the direct devDependency. None of these ship in the published package or the served dashboard bundle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Clears the four open Dependabot alerts on this repo, all in the web dashboard's build and test toolchain (
web/):None of these ship in the published Python package or in the served bundle, so no released version is affected.
vitest and @vitest/coverage-v8 go from 4.1.9 to 4.1.11 as direct devDependencies. browserslist and baseline-browser-mapping are forced through the existing
overridesblock instead, next to undici, since nothing in the dashboard imports them directly: they arrive through the PostCSS, autoprefixer and Vite chain. Patch and minor bumps only, no major version change.Worth flagging for review:
npm audit fixcrashes outright on this dependency graph (a known arborist bug in npm 10.9.8), so the bumps were done package by package instead.One high advisory remains in
npm audit, nanoid via postcss. GitHub's alert list doesn't flag it, it's dev-only in the same way, and it's left for a separate change.How I verified it
npm auditclears all four alertswebbuild succeeds and the rebuilt bundle is byte-identical to what's already committed undersrc/caucus/ui/, so no bundle churn rides alongChecklist
## [Unreleased]inCHANGELOG.md.PROTOCOL_TEXTchanged inhub.py,PROTOCOL_VERSIONwas bumped too. (not applicable, no protocol change)