chore: bump dependencies and fix security vulnerabilities - #331
Merged
Conversation
- bump GitHub Actions workflow versions (checkout, setup-node, create-github-app-token, semantic-release-action, yarn-lock-changes, gha-workflows techdocs template) - bump npm/yarn dependencies incl. major versions (eslint 8->9, prettier 2->3, jest-environment-jsdom 29->30, @rollup/plugin-commonjs 24->29, @commitlint/config-conventional 17->20, jsdoc-to-markdown 8->9, rollup-plugin-license, compare-versions) - migrate ESLint config from .eslintrc to flat config (eslint.config.js) via @eslint/eslintrc FlatCompat, required by ESLint 9 - bump eslint-plugin-prettier 4->5 for Prettier 3 compatibility - fix no-unused-vars error on unused catch binding, remove stale eslint-disable/eslint-env directives in test files - add yarn resolutions to patch Dependabot-flagged vulnerabilities: lodash, js-yaml (two branches), browserslist, baseline-browser-mapping - add yarn resolutions to patch additional transitive vulnerabilities surfaced by yarn audit: ajv, underscore, brace-expansion Verified locally: yarn lint, yarn test-unit, yarn build, prettier --check, and yarn audit (0 vulnerabilities) all pass. Co-authored-by: GitHub Copilot <copilot@noreply.github.com>
size-limit report 📦
|
actions/setup-node@v7 writes an .npmrc auth line referencing the NODE_AUTH_TOKEN env var for the scoped GitHub Packages registry. Unlike v4, yarn classic now fails to parse .npmrc during `yarn install --frozen-lockfile` if that env var isn't defined at all (not just empty), since the token was only set later for the actual Release step. Set it for the install step too so it's available when .npmrc is parsed. Co-authored-by: GitHub Copilot <copilot@noreply.github.com>
maximizeIT
force-pushed
the
chore/dependency-bumps-and-security-fixes
branch
from
September 10, 2026 01:04
b2960bf to
1ad4f89
Compare
This was referenced Sep 10, 2026
|
🎉 This PR is included in version 3.1.4 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates all currently open Dependabot PRs and security alerts into one branch.
GitHub Actions
actions/checkoutv6→v7actions/setup-nodev4→v7actions/create-github-app-tokenv1.10.3→v2.0.6cycjimmy/semantic-release-actionv4→v6Simek/yarn-lock-changesv0.12.0→v0.14.1Staffbase/gha-workflowstechdocs template v11.1.0→v16.0.0npm/yarn dependencies
eslint^8.35.0→^9.39.2 (major - migrated.eslintrc→eslint.config.jsflat config via@eslint/eslintrcFlatCompat)eslint-plugin-prettier^4.2.1→^5.5.6 (required for Prettier 3 compatibility - v4 used Prettier's removed sync API)prettier^2.8.4→^3.7.4 (major - verified no formatting drift viaprettier --check)jest-environment-jsdom^29.5.0→^30.2.0 (major)@rollup/plugin-commonjs24.0.1→29.0.0 (major)@commitlint/config-conventional17.4.4→20.2.0 (major)jsdoc-to-markdown^8.0.0→^9.1.3 (major)rollup-plugin-license3.6.0→3.7.1compare-versions^5.0.3→^6.1.1Security fixes (yarn
resolutions)Original Dependabot alerts:
lodash→ ^4.18.1js-yaml→ ^4.3.1 (and^3.15.1via@istanbuljs/load-nyc-config)browserslist→ ^4.28.7baseline-browser-mapping→ ^2.11.0Additional transitive vulnerabilities found via
yarn auditafter the bumps above (pre-existing onmain, not introduced by this PR, but fixed here):ajv(via@commitlint/config-validator) → ^8.18.0 (moderate, ReDoS)underscore(viajsdoc) → ^1.13.8 (high, DoS)brace-expansion(viaglob/minimatch) → ^2.1.4 (high, 2 DoS CVEs)CI regression found & fixed
Validated this PR end-to-end via a throwaway
betaprerelease branch (#332, now closed without merging, branch deleted) that published realx.y.z-beta.Nversions to npm to confirm nothing broke. This caught a genuine regression: bumpingactions/setup-nodev4→v7 in the release job causes yarn classic to hard-fail (Failed to replace env in config: ${NODE_AUTH_TOKEN}) onyarn install/yarn build, because setup-node@v7 writes an.npmrcreferencingNODE_AUTH_TOKENbefore that var was set in the job. Fixed here by hoistingNODE_AUTH_TOKENto thereleasejob's top-levelenv, so it's available to every step, not just theReleasestep.(The
betabranch also needed a second, unrelated fix — passing--tagtonpm publishfor prerelease channels — but that only matters when publishing a non-latestdist-tag, whichmainnever does, so it's not part of this PR.)Confirmed via the beta pipeline:
yarn install→yarn build→ semantic-release → npm publish all succeeded on a real CI run,npm view @staffbase/plugins-client-sdk dist-tagsshowed the new beta version published, and it was installed/built/type-checked successfully in a downstream consumer app (cc-plugins-client-sdk-showcase#1115, also a throwaway test PR).Verification
All run clean locally:
yarn lint(ESLint 9 flat config + Prettier 3)yarn test-unit(6 suites, 52 tests, 13 snapshots, all pass)npx prettier --check(no formatting drift)yarn build(rollup build succeeds)yarn audit→ 0 vulnerabilities across 848 dependencies🤖 Generated with assistance from GitHub Copilot.