chore(deps): update dependencies before v0.1.0 - #102
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Clears the form-data CRLF injection advisory (GHSA-hmw2-7cc7-3qxx) in the build-time OpenAPI sample rendering dependency chain by forcing an in-range patched form-data, and refreshes the lockfile to pick up already-allowed patch updates (notably Astro, sharp, and lint-staged).
Changes:
- Add an npm
overridesrule to forceform-datato^4.0.6(resolving the advisory while staying within major v4). - Update
package-lock.jsonto reflect the newform-data@4.0.6resolution and take in-range patch updates (astro,sharp,lint-staged), plus the resulting transitive lock refresh.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Adds overrides to force patched form-data resolution. |
| package-lock.json | Locks form-data@4.0.6 and refreshes resolved versions for in-range patch bumps (and transitives). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
34 tasks
Clear the form-data advisory with an override. Refresh every compatible dependency before the first tag. Upgrade Astro to 7.2.10 and Starlight to 0.42.0 with current plugins. Refresh all in-range transitive dependencies. Keep TypeScript 6.0.3 because @astrojs/check does not accept TypeScript 7. All Actions already use current major pins, so workflows need no edits. Verified under Node 24 with npm audit, 118 tests, links, full build, and registry dump. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
maehr
force-pushed
the
chore/deps-pre-tag
branch
from
September 2, 2026 17:37
33dda2f to
63b9c8b
Compare
maehr
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refreshes every compatible dependency before the first tag and clears GHSA-hmw2-7cc7-3qxx with the existing
form-dataoverride.The coordinated framework update moves Astro to 7.2.10 and Starlight to 0.42.0, together with sitemap 3.7.4, starlight-blog 0.29.0, links-validator 0.26.0, sharp 0.35.4, Zod 4.5.4, lint-staged 17.4.1, tsx 4.23.13,
@astrojs/check0.9.10, starlight-openapi 0.26.1, and current compatible transitive releases.Deliberate exceptions
@astrojs/checkpeer range accepts TypeScript 5 or 6, not 7.npm outdatedreports this as the only remaining direct update.Verification
Run under Node 24 after a clean
npm ci:npm audit— 0 vulnerabilitiesastro check— 0 errorsThe
data/submodule is unchanged.