Bump the dev-dependencies group across 1 directory with 7 updates - #58
Merged
shinyaoguri merged 1 commit intoMay 17, 2026
Conversation
dependabot
Bot
added
dependencies
Bumps the dev-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.8.0` | | [rollup](https://github.com/rollup/rollup) | `4.60.2` | `4.60.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.10` | `8.0.13` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.5` | `4.1.6` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260426.1` | `4.20260517.1` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.86.0` | `4.92.0` | Updates `@types/node` from 25.6.0 to 25.8.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `rollup` from 4.60.2 to 4.60.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.60.2...v4.60.4) Updates `vite` from 8.0.10 to 8.0.13 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.13/packages/vite) Updates `vitest` from 4.1.5 to 4.1.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/vitest) Updates `@vitest/coverage-v8` from 4.1.5 to 4.1.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/coverage-v8) Updates `@cloudflare/workers-types` from 4.20260426.1 to 4.20260517.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `wrangler` from 4.86.0 to 4.92.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.92.0/packages/wrangler) --- updated-dependencies: - dependency-name: "@cloudflare/workers-types" dependency-version: 4.20260517.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@types/node" dependency-version: 25.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: rollup dependency-version: 4.60.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vite dependency-version: 8.0.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: vitest dependency-version: 4.1.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: wrangler dependency-version: 4.92.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/develop/dev-dependencies-2d5907fdbf
branch
from
May 17, 2026 14:27
51eb6ca to
b789bc7
Compare
shinyaoguri
deleted the
dependabot/npm_and_yarn/develop/dev-dependencies-2d5907fdbf
branch
May 17, 2026 14:34
10 tasks
shinyaoguri
added a commit
that referenced
this pull request
Sep 9, 2026
## Summary `Dependabot Updates` の security update (`npm_and_yarn in /. for sharp`) が failure し続けていた件を、root の `overrides` で塞ぐ。あわせて dead になっていた `uuid` override を外す。 miniflare が sharp を範囲ではなく **exact `0.35.2`** で要求しているため dependabot は脆弱版から動かせず、最新の `miniflare@5.20260908.0-alpha` も同じ pin なので wrangler / miniflare を上げても解決しない (#288 で wrangler を 4.115.0 → 4.127.1 に上げた後も alert は open のままだった)。override が唯一の手段になる。#259 で `undici` に対して行ったのとまったく同じパターンの二例目。 ``` typedcode@1.1.0 `-- wrangler@4.127.1 (dev) `-- miniflare@5.20260828.0-alpha `-- sharp@0.35.2 <- exact pin ``` **影響度**: `GHSA-rgj7-g3m4-5g8c` (high) / sharp `< 0.35.4` / libheif の HEIF・AVIF デコード脆弱性。scope は development で本番 Worker には配布されない。sharp は miniflare の Images binding ハンドラ内で動的 import されるだけだが、本リポの wrangler 設定 3 つに Images binding は無く `packages/workers/src` に `IMAGES` の参照も無いため、インストールされるだけで実行されない。実行時のリスクではなく衛生の問題 (high alert が open のまま、Dependabot Updates が毎回赤、`npm audit` が赤)。 **変更点**: - `overrides` に `"sharp": "^0.35.4"` を追加 (`0.35.2 → 0.35.4` は patch で API 互換) - dead になっていた `"uuid": "^11.1.1"` override を削除。唯一の依存元だった `vite-plugin-top-level-await` を #256 で外した時点で dead になっており、lock に要求元もエントリも無い (#259 は同じ原因で dead になった rollup override だけを外し、uuid を見落としていた) - lock の差分は sharp 本体と `@img/sharp-*` / `@img/sharp-libvips-*` のプラットフォームバイナリ群のみで、他の依存は動いていない 残る override のうち `dompurify` は live で必須 (`monaco-editor@0.56.0` の exact `3.4.8` を上書きして 3.4.14 に載せている)。`vite` / `ws` / `undici` は現時点では冗長だが floor としては無害なので今回は触らない。 ## Test plan `npm ci --include=optional` でクリーンに入れ直した上で、CI の 3 ジョブに対応するコマンドを一式ローカルで実行した。 - [x] `npm audit` — high **3 件 → 0 件** (`sharp` / それを含む `miniflare` / `wrangler` がすべて消えた) - [x] `npm ls sharp` — `wrangler@4.127.1 → miniflare@5.20260828.0-alpha → sharp@0.35.4` に解決。optional なプラットフォームバイナリ (`@img/sharp-*`) も解決漏れなし - [x] `npm run build` — 全パッケージビルド成功 - [x] `npm run typecheck` / `npm run lint` — pass (lint の warning / info は既存分のみ) - [x] `npm run test:run --workspaces --if-present` — 820 件 pass / 3 skip - [x] `npm run deploy:staging -w @typedcode/workers -- --dry-run` / 同 `deploy:production` — 両方成功 - [x] `npm run test -w @typedcode/e2e` — 17 件 pass。**wrangler dev (= miniflare) が実際に起動する唯一の経路**で、sharp 0.35.4 入りの node_modules で正常に動くことの確認 - [x] `npm run test:build -w @typedcode/e2e` — 1 件 pass ## Documentation impact - [x] 上記いずれも該当なし (依存の解決版のみの変更で、不変条件・公開仕様・環境変数に影響しない) ## ADR (該当する場合) - [x] N/A ## Related issues / PRs Closes #307 - #259 — `undici` を override で上げ、dead な rollup override を外した先例。今回はその二例目 - #270 — 同型の nanoid の件。**#288 (dev deps 一括更新) で postcss が 8.5.26 に上がり `nanoid@3.3.18` に解決されたことで既に解消済み** (alert #58 は fixed)。この PR には含めず、Issue 側に事実を記録して close する。#270 のトリアージが宿題として挙げていた dead override (`uuid`) の掃除だけをこの PR に取り込んだ - #287 / #288 / #289 — この件に気づいた dependabot PR (いずれもマージ済み)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the dev-dependencies group with 6 updates in the / directory:
25.6.025.8.04.60.24.60.48.0.108.0.134.1.54.1.64.20260426.14.20260517.14.86.04.92.0Updates
@types/nodefrom 25.6.0 to 25.8.0Commits
Updates
rollupfrom 4.60.2 to 4.60.4Release notes
Sourced from rollup's releases.
Changelog
Sourced from rollup's changelog.
Commits
d311a844.60.46aa3248fix: stabilize chunk assignment across parallel file reads (#6362)82a0fe7Resolve vulnerabilities (#6375)71f5ebcchore(deps): update dependency lru-cache to v11 (#6371)af91d77chore(deps): lock file maintenance (#6373)65e7b94chore(deps): update react monorepo to v19 (major) (#6372)642587ffix(deps): update minor/patch updates (#6370)b47bdab4.60.315c5f33Add again some unneeded dev dependencies, to make some builds succeed12195dcfix: do not rename nested "exports" bindings that do not conflict (#6360)Updates
vitefrom 8.0.10 to 8.0.13Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
a46f11arelease: v8.0.13d9b18e0fix(ssr): avoid rewriting labels that collide with imports (#22451)4f0949ffeat(bundled-dev): add lazy bundling support (#21406)158e8aefix(build): copy public directory after building same environment with `write...47071cefeat(optimizer): improve the esbuild plugin converter to pass some properties...8e59c97fix(css): keep deprecatedname/originalFileNamein synthetic `assetFileNa...a576326fix: makeisBundledper environment (#22257)8c766a6feat: update rolldown to 1.0.1 (#22444)b7edcb7fix(css): await sass/less/styl worker disposal on teardown (fix #22274) (#22275)fcdc87cchore: update changelog (#22413)Updates
vitestfrom 4.1.5 to 4.1.6Release notes
Sourced from vitest's releases.
Commits
a8fd24cchore: release v4.1.618af98cfix(browser): simplify orchestrator otel carrier (#10285)3188260feat(browser): provide project reference inToMatchScreenshotResolvePath(#...Updates
@vitest/coverage-v8from 4.1.5 to 4.1.6Release notes
Sourced from @vitest/coverage-v8's releases.
Commits
a8fd24cchore: release v4.1.6Updates
@cloudflare/workers-typesfrom 4.20260426.1 to 4.20260517.1Commits
Updates
wranglerfrom 4.86.0 to 4.92.0Release notes
Sourced from wrangler's releases.
... (truncated)
Commits
a3fa623Version Packages (#13918)802eaf4fix(wrangler): stop rewriting query strings that contain the request Host (#1...2e72c83[wrangler] Preserve placement on versions secret commands (#13843)19ed49abuild(deps): bump the workerd-and-workers-types group with 2 updates (#13926)3ff0a50fix: wrangler types decouple env-interface from namespace (#11471)506aa02[wrangler] Add artifacts CLI commands (#13670)8f5cdb1fix(wrangler): hide multi-env warning when env is set via CLOUDFLARE_ENV (#13...be8a98crefactor deploy/versions upload (part 1) (#13916)bf688f7[wrangler] fix: re-read refresh_token from disk to avoid 401 from sibling-pro...adbf8cbVersion Packages (#13895)