chore(deps): bump undici to patch Dependabot alerts - #109
Open
ClaudiaFang wants to merge 1 commit into
Open
Conversation
Refreshes package-lock.json to pick up undici 6.28.0 (via the existing @actions/http-client override) and 7.29.0 (top-level, used by @octokit/*, jsdom). Both are already within the semver ranges already permitted by package.json - no override changes needed. Fixes Dependabot alerts #36-40, #43-45. Remaining open alerts (#34, #35, #42 ip-address; brace-expansion, tar, undici<6.28 under npm/node-gyp) are bundled dependencies of the npm CLI package itself (bundleDependencies), which npm overrides cannot reach. Verified across npm 11.18.0, 11.19.0, and 12.0.2 - all three bundle the same vulnerable versions. These require an upstream npm CLI release and cannot be fixed from this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
ClaudiaFang
force-pushed
the
main
branch
2 times, most recently
from
August 7, 2026 02:55
4f78bfa to
5ab9bf8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
package-lock.jsonsoundiciresolves to6.28.0(via the existing@actions/http-clientoverride) and7.29.0(top-level, pulled in by@octokit/*via@semantic-release/github, and byjsdom).package.json— this is a lockfile-only refresh, nooverrideschanges needed.main) — same fix, rebased onto latestmain.Not fixed (upstream limitation)
Alerts #34, #35, #42 (
ip-address), plustar,brace-expansion, and oneundicioccurrence, all resolve to copies bundled inside thenpmCLI package itself (bundleDependenciesin npm's ownpackage.json). npm'soverridesfield cannot reach into a package's bundled dependencies — verified this is unfixable by testing npm CLI versions 11.18.0, 11.19.0, and 12.0.2, all of which bundle the same vulnerable versions.npmis a transitive dev dependency of@semantic-release/npm(used only during the release-publish CI step, not in the shipped plugin). These will need to stay open until npm CLI ships a release with updated bundled deps.Test plan
npx eslint .→ 0 errorsnpm run build→ passes (incl. Obsidian 1.11.0 compat typecheck)npx vitest run→ 496 passed (34 files)🤖 Generated with Claude Code