## Summary - Resolved open Dependabot security alerts by updating the direct `postcss` dependency and adding resolutions to pin transitive dependencies to patched versions. Note: alert open-feature#80 (`tsup` DOM clobbering, low) has no patched version available and is skipped. Alerts open-feature#108 and open-feature#104 (mermaid) are already fixed by the direct `mermaid@11.10.0` dependency. Alerts open-feature#204 and open-feature#205 (fast-xml-builder) are already fixed by the `fast-xml-parser: ^5.7.0` resolution pulling in `fast-xml-builder@1.2.0`. ## Dependabot Alerts Resolved | Alert | Package | Severity | Fix | |-------|---------|----------|-----| | open-feature#208 | `@babel/plugin-transform-modules-systemjs` | **high** | Pinned to >=7.29.4 via resolutions | | open-feature#207 | `fast-uri` | **high** | Pinned to >=3.1.2 via resolutions | | open-feature#206 | `fast-uri` | **high** | Pinned to >=3.1.2 via resolutions | | open-feature#205 | `fast-xml-builder` | **high** | Already fixed via `fast-xml-parser: ^5.7.0` resolution | | open-feature#204 | `fast-xml-builder` | **medium** | Already fixed via `fast-xml-parser: ^5.7.0` resolution | | open-feature#203 | `ip-address` | **medium** | Pinned to >=10.1.1 via resolutions | | open-feature#202 | `postcss` | **medium** | Bumped direct dep to ^8.5.10; forced via resolutions | | open-feature#131 | `webpack` | **low** | Pinned to 5.99.9 via resolutions | | open-feature#130 | `webpack` | **low** | Pinned to 5.99.9 via resolutions | | open-feature#113 | `js-yaml` | **medium** | Scoped to markdownlint-cli2/js-yaml: >=4.1.1 via resolutions | --------- Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>

update dependency #205

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions