chore(deps): consolidate dependency upgrades & clear security advisories - #263
Merged
Conversation
…ories Supersedes the 7 open Dependabot PRs (#232, #233, #249, #252, #253, #259, #260) with a single verified upgrade that keeps the site building. - astro 6.4.6 → 7.1.6 (major) - @astrojs/preact 4.1.3 → 6.0.0 (major, required by astro 7) - @astrojs/rss 4.0.12 → 4.0.19 - archiver 7.0.1 → 8.0.0 (major; now ESM, no default export) - overrides: sharp ^0.35.3, svgo ^4.0.2, and a scoped @astrojs/preact→vite ^6.4.3 to clear transitive advisories without forcing astro's own vite 8 down archiver 8 dropped its default export, so SKILL.zip.ts migrates to the `ZipArchive` class (same instance API). Adds an `npm run build` gate to CI: skill-validator only runs when skills change, so dependency PRs previously passed CI without ever building the site — the real build only ran post-merge in deploy-ic.yml. Result: `npm audit` reports 0 vulnerabilities (was 10), `npm run build` produces 30 pages with all 26 SKILL.zip files valid and llms.txt / sitemap / .well-known/skills/index.json intact.
…runtime) The incremental npm install left the lockfile internally inconsistent: it listed @img/sharp-wasm32 (which requires @emnapi/runtime/@emnapi/core via the sharp 0.35.3 override) but omitted those packages, so npm ci failed on Linux CI with 'Missing: @emnapi/runtime@1.11.3 from lock file'. Regenerated from a clean install; npm ci, build, and audit (0 vulns) all pass.
Skill Validation ReportNo skill files were changed in this PR — validation skipped. |
lwshang
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the 7 open Dependabot PRs into a single upgrade that is verified to keep the site building, and takes
npm auditfrom 10 vulnerabilities → 0.Why one PR instead of merging the Dependabot PRs
The Dependabot PRs overlap and conflict, and CI never built the site — the
checks / validatejob only runs skill-validator, and only when a skill file changes. Dependency PRs touch justpackage.json/package-lock.json, so validation was skipped entirely and the check went green without ever runningastro build. The real build only happens post-merge indeploy-ic.yml. Merging these blind risked breaking production.Concretely, the Dependabot PRs were inconsistent:
@astrojs/preactat v4Changes
astro@astrojs/preact@astrojs/rssarchiversharp ^0.35.3,svgo ^4.0.2, scoped@astrojs/preact→vite ^6.4.3archiver 8 breaking change: archiver 8 is pure ESM and dropped its default export, so
import archiver from 'archiver'throws at build time.SKILL.zip.tsmigrates to theZipArchiveclass (identical instance API —append/finalize/pipe/on).Scoped vite override: the vulnerable vite (≤6.4.2) comes only from
@astrojs/preact's dev tooling. A globalviteoverride forced Astro 7's own vite (needs v8) down to 6.4.3 and broke the build, so the override is scoped to the@astrojs/preactsubtree only — Astro keeps vite 8.2.0.CI build gate: adds
npm run buildto the checks workflow so every PR (including future dependency bumps) is verified to build, closing the gap that let these PRs go green without building.Verification
npm auditandnpm run buildoutput```
$ npm audit
found 0 vulnerabilities # was 10 (2 low, 1 moderate, 7 high)
$ npm run build
[build] 30 page(s) built
[@astrojs/sitemap] sitemap-index.xml created at dist
[build] Complete!
post-build checks
All 26 SKILL.zip files valid
llms.txt + sitemap-index.xml + .well-known/skills/index.json present
```
Installed: astro 7.1.6 · @astrojs/preact 6.0.2 · archiver 8.0.0 · sharp 0.35.3 · svgo 4.0.2 · vite 8.2.0 (astro) / 6.4.3 (preact subtree)
Follow-up
Once merged, close the superseded Dependabot PRs: #232, #233, #249, #252, #253, #259, #260.
🤖 Generated with Claude Code