From c3c97be3cd30ede955cb10d7c2616c8e3fe609b3 Mon Sep 17 00:00:00 2001 From: Jonathan Norris Date: Tue, 8 Sep 2026 09:53:46 -0400 Subject: [PATCH 1/3] chore: resolve open dependabot security alerts - toml <4.1.2 -> 5.0.0 via npm override (high, alert #42) Signed-off-by: Jonathan Norris --- package-lock.json | 20 ++++++++++++-------- package.json | 3 +++ 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 08605c26..49037243 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2530,10 +2530,14 @@ } }, "node_modules/toml": { - "version": "2.3.6", - "resolved": "https://registry.npmjs.org/toml/-/toml-2.3.6.tgz", - "integrity": "sha512-gVweAectJU3ebq//Ferr2JUY4WKSDe5N+z0FvjDncLGyHmIDoxgY/2Ie4qfEIDm4IS7OA6Rmdm7pdEEdMcV/xQ==", - "dev": true + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.0.tgz", + "integrity": "sha512-bsqEd+g7fzlrw7LEynQ6W6aOK/lTOlepz5x1sJyIV9fTZVJS2Q76nuju6FK+gZhW5bUpvB7mCEqdR0u4WziMFw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=20" + } }, "node_modules/tslib": { "version": "2.4.0", @@ -3108,7 +3112,7 @@ "coffee-script": "^1.12.4", "extend-shallow": "^2.0.1", "js-yaml": "^3.8.1", - "toml": "^2.3.2" + "toml": ">=4.1.2" } }, "gulp-header": { @@ -4289,9 +4293,9 @@ } }, "toml": { - "version": "2.3.6", - "resolved": "https://registry.npmjs.org/toml/-/toml-2.3.6.tgz", - "integrity": "sha512-gVweAectJU3ebq//Ferr2JUY4WKSDe5N+z0FvjDncLGyHmIDoxgY/2Ie4qfEIDm4IS7OA6Rmdm7pdEEdMcV/xQ==", + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.0.tgz", + "integrity": "sha512-bsqEd+g7fzlrw7LEynQ6W6aOK/lTOlepz5x1sJyIV9fTZVJS2Q76nuju6FK+gZhW5bUpvB7mCEqdR0u4WziMFw==", "dev": true }, "tslib": { diff --git a/package.json b/package.json index d61400fb..185dbe12 100644 --- a/package.json +++ b/package.json @@ -9,5 +9,8 @@ "markdown-toc": "^1.2.0", "markdownlint-cli": "^0.49.1", "prettier": "^3.0.0" + }, + "overrides": { + "toml": ">=4.1.2" } } From c29809b786bd5f94c364e387b86c275013a56b75 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 8 Sep 2026 18:35:27 +0000 Subject: [PATCH 2/3] ci: retry rate-limited markdown links Co-authored-by: jonathannorris <1219069+jonathannorris@users.noreply.github.com> --- .markdown-link-check-config.json | 1 + 1 file changed, 1 insertion(+) diff --git a/.markdown-link-check-config.json b/.markdown-link-check-config.json index 96c10500..e6e8ef74 100644 --- a/.markdown-link-check-config.json +++ b/.markdown-link-check-config.json @@ -1,4 +1,5 @@ { + "retryOn429": true, "ignorePatterns": [ { "pattern": ".*split.io.*" From 9e1186dcfc80aa783bfd1fc31293b5a82ab6510d Mon Sep 17 00:00:00 2001 From: Jonathan Norris Date: Tue, 15 Sep 2026 13:20:04 +0200 Subject: [PATCH 3/3] chore: resolve open dependabot security alerts - js-yaml 3.15.1 -> 3.15.2 (high, alert #45) - js-yaml 4.3.1 -> 4.3.2 (high, alert #44) - ignore cloud-native.slack.com archive links in markdown-link-check (403 due to Slack blocking unauthenticated crawlers, unrelated to dependency changes but needed to keep json-lint CI green) Signed-off-by: Jonathan Norris --- .markdown-link-check-config.json | 3 +++ package-lock.json | 24 ++++++++++++------------ 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/.markdown-link-check-config.json b/.markdown-link-check-config.json index e6e8ef74..a9d29345 100644 --- a/.markdown-link-check-config.json +++ b/.markdown-link-check-config.json @@ -6,6 +6,9 @@ }, { "pattern": ".*openfeature.dev/docs/reference/other-technologies/ofrep/openapi.*" + }, + { + "pattern": ".*cloud-native\\.slack\\.com/archives/.*" } ] } \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index 49037243..f42af6b1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -993,9 +993,9 @@ } }, "node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": { @@ -2597,9 +2597,9 @@ "dev": true }, "node_modules/xmlbuilder2/node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { @@ -3299,9 +3299,9 @@ } }, "js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "requires": { "argparse": "^1.0.7", @@ -4347,9 +4347,9 @@ "dev": true }, "js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "requires": { "argparse": "^2.0.1"