Repository navigation
fix(deps): resolve npm audit vulnerabilities - #23
Merged
Merged
Conversation
npm audit reported 8 advisories (2 high, 6 moderate), all in dev dependencies: - vite 8.3.2 -> 8.3.5 (six advisories, including launch-editor) - vitest / @vitest/mocker -> 5.0.5 (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp) - undici -> 7.30.1 via release-it 21.1.2 (eight advisories) - ip-address -> 10.7.5 (GHSA-rxp7-6hxx-x8q5) - minimatch (GHSA-g3hv-75wg-m249), via npm-run-all All but minimatch came from `npm audit fix`. minimatch@3 was pulled in by npm-run-all@4.1.5, which has not been released since 2018, and npm's only fix was downgrading it to 1.1.3. It is replaced with npm-run-all2, the maintained fork, which ships the same `npm-run-all` binary so the build script is unchanged. It requires Node ^22.22.2 || ^24.15.0; CI uses 24. The published package has zero runtime dependencies, so nothing consumers install changes.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues for the development-dependency security updates.
No open issues 🎉
What changed in this PR
This PR addresses security advisories in development dependencies without changing the XML library’s source or runtime dependencies.
Changes:
- Replaces
npm-run-allwith the maintainednpm-run-all2fork, preserving the existing build command and removing the vulnerable minimatch dependency. - Updates locked tooling dependencies, including Vite, Vitest, release-it/undici, and ip-address, and removes obsolete transitive packages.
| File | Description |
|---|---|
package.json |
Switches the development task runner to npm-run-all2. |
package-lock.json |
Records patched dependency versions and removes the legacy task runner’s dependency tree. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all 8
npm auditadvisories (2 high, 6 moderate) and the 9 open Dependabot alerts. Every affected package is a dev dependency.All but minimatch came from
npm audit fix.npm-run-all → npm-run-all2
minimatch@3 came in through
npm-run-all@4.1.5, which hasn't been released since 2018. npm's only offered fix was downgrading it to 1.1.3. This PR swaps it fornpm-run-all2, the maintained fork. It ships the samenpm-run-allbinary, so thebuildscript is unchanged. It requires Node^22.22.2 || ^24.15.0 || >=26; CI uses Node 24.Changelog
No entry. Nothing under
src/changed and the published package has zero runtime dependencies, so consumers install exactly what they did before. An entry would also turn the next release into a version bump with no change for users. This matches #21.Testing
npm audit: 0 vulnerabilitiesnpm run buildsucceedsnpm test: 127/127 passnpm run format:checkandnpm run lintare clean