chore: resolve open dependabot security alerts#24
Merged
Conversation
- fast-uri 3.1.0 -> 3.1.2 (high, alerts #115 #116) - ip-address 10.1.0 -> 10.1.1 (medium, alert #114) - picomatch 4.0.3 -> 4.0.4 (medium, alert #113) - @semantic-release/npm bumped to >=13.0.0 to pull in npm@11 with patched bundled deps
There was a problem hiding this comment.
Pull request overview
This PR aims to resolve outstanding Dependabot security alerts by updating vulnerable transitive npm dependencies via overrides, updating the lockfile accordingly, and aligning GitHub Actions CI Node.js versions with new engine requirements introduced by updated release tooling.
Changes:
- Updated
package.jsonoverridesto pull patched versions offast-uri,ip-address, and@semantic-release/npm, plus a targetedtinyglobby -> picomatchoverride. - Regenerated
package-lock.jsonto reflect the overrides and updated transitive dependency graph (notably@semantic-release/npmand bundlednpm). - Pinned GitHub Actions workflows to Node
22.14.x, and ignored.worktrees/in git and prettier configs.
Reviewed changes
Copilot reviewed 5 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Adds/adjusts npm overrides for vulnerable transitive dependencies (and introduces a targeted tinyglobby override). |
| package-lock.json | Lockfile update reflecting new override resolutions and dependency tree changes. |
| .prettierignore | Ignores .worktrees/ from prettier checks. |
| .gitignore | Ignores .worktrees/ from git. |
| .github/workflows/test.yml | Pins CI test job Node version to 22.14.x. |
| .github/workflows/release.yml | Pins release workflow Node version to 22.14.x. |
| .github/workflows/benchmark.yml | Pins benchmark workflow Node version to 22.14.x. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
31
to
+36
| "overrides": { | ||
| "handlebars": "^4.7.9", | ||
| "picomatch": "^2.3.2", | ||
| "tinyglobby": { | ||
| "picomatch": "4.0.4" | ||
| }, |
| @@ -31,9 +31,15 @@ | |||
| "overrides": { | |||
JamieSinn
approved these changes
Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@semantic-release/npmto >=13.1.5 to satisfy engine requirements and pull in patched npm@11 bundled deps@semantic-release/npm@13.1.5engine requirementDependabot Alerts Resolved
fast-uriip-addresspicomatch