chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates - #87
Closed
dependabot[bot] wants to merge 0 commit into
Closed
Conversation
dependabot
Bot
added
dependencies
Ndevu12
force-pushed
the
dependabot/npm_and_yarn/examples/nextjs-demo/npm_and_yarn-b3a868dd58
branch
from
May 26, 2026 20:46
8023a42 to
8acf068
Compare
dependabot
Bot
deleted the
dependabot/npm_and_yarn/examples/nextjs-demo/npm_and_yarn-b3a868dd58
branch
May 26, 2026 20:46
Ndevu12
added a commit
that referenced
this pull request
Aug 1, 2026
…es (#112) Takes open Dependabot alerts from **5 to 0**. I previously argued against `resolutions` for these. That was the right default but the wrong final answer — I had not actually tested whether the forced versions work. I have now, and they do, so here they are with the evidence. ## Why a bump could not fix these All five are pinned by an upstream package rather than declared in any manifest here, so there is no floor to raise: | Alert | Package | Pinned by | |---|---|---| | #50 | `esbuild` | `tsup@8.5.1` (latest) declares `esbuild@^0.27.0` — cannot reach patched 0.28.1 | | #24 #102 #104 | `postcss` | `next` depends on **exactly** `postcss@8.4.31` | | #87 | `sharp` | `next` declares `sharp@^0.34.5`; fix is 0.35.0, outside the range | I checked `next@16.2.12` (latest, a major upgrade): it **still** pins `postcss@8.4.31`. So even upgrading Next by a major would not have closed those three. ## The overrides, and what verified them **Root — `esbuild: ^0.28.1`.** Forcing this collapses the tree to a single esbuild copy (0.27.7 is gone entirely). The risk was that `tsup` and `tsx`, which declared `^0.27.0` / `~0.27.0`, would break against 0.28. They do not: - `yarn build` — tsup compiles the library (CJS + ESM + DTS) - `yarn clean` — a `tsx`-executed script runs - `yarn build-storybook` — succeeds - `yarn test:coverage` — **286 tests pass, 92.9% statements / 84.1% branches** - `yarn typecheck`, `yarn lint`, `yarn format:check` — clean **`examples/nextjs-demo` — `postcss: ^8.5.25`, `sharp: ^0.35.3`.** The risk was Nexts CSS pipeline depending on postcss 8.4.31 internals. It does not: - `yarn build` — compiles successfully, prerenders all 3 static pages ## These are liabilities, and the PR says so An override forces a version upstream never tested against. Left undocumented that is exactly the debt worth avoiding, so `SECURITY.md` now carries a **Dependency overrides** section recording, for each entry: what pins the package, which advisory it answers, **the precise condition for removing it**, and the commands to check whether upstream has caught up: ```sh npm view tsup dependencies.esbuild npm view next dependencies.postcss optionalDependencies.sharp ``` They should be deleted the moment `tsup` ships against `esbuild@^0.28` and `next` moves off `postcss@8.4.31`. ## Verification of the outcome Cross-checking every open alert against the resulting lockfiles: ``` Open alerts RESOLVED by this branch: 5 Still vulnerable: 0 ``` Plus the standing invariant, re-run: every **direct** dependency across all four manifests still declares a floor at or above its patched version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /examples/nextjs-demo directory: next.
Bumps the npm_and_yarn group with 2 updates in the /examples/react-demo directory: postcss and ip-address.
Bumps the npm_and_yarn group with 2 updates in the /playground directory: postcss and ip-address.
Updates
nextfrom 15.5.15 to 15.5.18Release notes
Sourced from next's releases.
Commits
9ff92cev15.5.1800ebe23[backport] Disable build caches for production/staging/force-preview deploys ...62c97abv15.5.17423623aTurbopack: Match proxy matchers with webpack implementation (#93594)fa78739Turbopack: Fix middleware matcher suffix (#93590)36e62c6[backport] Turbopack: more strict vergen setup (#93588)36589b5[backport][test] Pin package manager to patch versions (#93596)ad6fd4ev15.5.1679d7dffIgnore malformed CSP nonce headers (#103)c4f6908router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.
Updates
postcssfrom 8.5.8 to 8.5.14Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
3ec1394Release 8.5.14 versionf2bb827Update dependenciesd75953dMerge pull request #2084 from 43081j/raw-raws-rawing68bd213fix: always callrawto retrieve raw valuesaf58cf1Release 8.5.13 versionf227dbdTemporary ignore pnpm 11 configd3abd40Update dependenciesdd06c3eRevert stringifier changes because of the conflict with postcss-scssae889c8Try to fix CIe0093e4Move to pnpm 11Updates
ip-addressfrom 10.1.0 to 10.2.0Commits
Updates
postcssfrom 8.5.8 to 8.5.14Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
3ec1394Release 8.5.14 versionf2bb827Update dependenciesd75953dMerge pull request #2084 from 43081j/raw-raws-rawing68bd213fix: always callrawto retrieve raw valuesaf58cf1Release 8.5.13 versionf227dbdTemporary ignore pnpm 11 configd3abd40Update dependenciesdd06c3eRevert stringifier changes because of the conflict with postcss-scssae889c8Try to fix CIe0093e4Move to pnpm 11Updates
ip-addressfrom 10.1.0 to 10.2.0Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.