fix(deps): bump vulnerable transitive dependencies - #2117
Merged
Conversation
Resolves all 11 open Dependabot alerts. Only the four advisory-affected packages are updated, within the existing semver ranges; every other lockfile change is a mechanical peer-dependency key rewrite. No manifest changes. - brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895, high, runtime) - postcss 8.5.21 -> 8.5.25 (GHSA-fxqj-rqcc-2cmp, moderate, runtime) - fast-uri 3.1.4 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7, high, dev) - undici 6.27.0 -> 6.28.0 and 7.28.0 -> 7.29.0 (4 advisories, dev) The brace-expansion advisory reaches production through rimraf > glob > minimatch and was failing the audit workflow's `pnpm audit --prod --audit-level=high` gate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for gethinode-demo ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
markdumay
enabled auto-merge
August 4, 2026 07:53
Collaborator
Author
|
🎉 This PR is included in version 3.18.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all 11 open Dependabot alerts and unblocks the
auditworkflow.What changed
pnpm-lock.yamlonly — no manifest changes. Only the four advisory-affected packages were updated, within the existing semver ranges.brace-expansionpostcssfast-uriundiciThe
brace-expansionadvisory reaches production throughrimraf > glob > minimatchand was failing the audit workflow'spnpm audit --prod --audit-level=highgate on #2113.Why the diff is 150/150
Exactly five version lines changed — the five vulnerable ones. Every other changed line is a mechanical peer-dependency key rewrite (
(postcss@8.5.21)→(postcss@8.5.25)), where the package's own version is unchanged.Verification
Run from a clean
node_modules(rm -rf node_modules && pnpm install --frozen-lockfile):pnpm audit --prod --audit-level=high→ no known vulnerabilitiespnpm audit(all severities, incl. dev) → no known vulnerabilitiespnpm install --frozen-lockfile→ lockfile and manifest consistentpnpm test(eslint, stylelint, markdownlint, template tests) → 0 issuespnpm build:example→ 149 pages EN/FR/NL, exit 0CSS output is byte-identical to
main.postcssis the core of the styles pipeline, somainwas built at 8.5.21 and compared against this branch at 8.5.25: all four of Hugo's content-hashed stylesheet filenames match exactly (main.min.3c500e28…, plus leaflet/mermaid/simple-datatables). The bump is output-neutral.All patched versions were published 4–11 days ago, so they clear both
.npmrc#minimum-release-age(1440 min) anddependabot.yml#cooldown(2 days).🤖 Generated with Claude Code