Keep SDK dev toolchain audit clean#6
Conversation
The Dependabot lockfile bumps left dev-only audit findings in the local dependency graph, so this refreshes the package lock to patched YAML, Rollup, and PostCSS versions while preserving the published SDK version and API. Constraint: npm audit reported dev-only advisories after merging Dependabot PRs #3 and #4 Rejected: Ignore dev advisories | the SDK build and test toolchain still consumes these packages locally and in CI Confidence: high Scope-risk: narrow Tested: npm run typecheck; npm test; npm run build; npm audit --audit-level=moderate Not-tested: npm publish dry-run
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary
Verification
Notes
Dependabot PRs #3 and #4 were merged first; this handles the remaining full dev-audit findings reported after syncing the merged lockfile.