chore(deps): Bump the minor-and-patch group across 1 directory with 7 updates - #638
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
williamzujkowski
added a commit
that referenced
this pull request
Sep 24, 2026
… that don't Dependabot's npm PRs have failed every required check since at least September 12 (#540, upstream dependabot/dependabot-core#16232). Open PR #638 is the fourth. It loses overrides two ways, and only one of them says so. The loud half: the bot drops the lockfile's `overrides:` header, so `pnpm install --frozen-lockfile` refuses with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. That message names neither the cause nor the fix, which is why this was diagnosed from scratch more than once -- and got it wrong the first time (#533, disproved 3m43s later by #537). The silent half: the bot also re-resolves parent-scoped overrides. On #638's lockfile `satori@0.33.4` is back on `fflate: 0.7.3`, reopening GHSA-px8p-9vwx-vf98. Nothing in CI could see this. Two cheaper checks were tried against #638's actual lockfile and both pass it, which is why the new check reads the resolved graph: - `grep -q '^overrides:'` passes on a lockfile whose header was restored by hand while the resolution stayed regressed. That is precisely what #540 warns against: "Do not repair only the header." - "is fflate@0.7.5 present?" passes too, because @shuding/opentype.js depends on 0.7.5 independently. The patched version being in the tree says nothing about whether SATORI uses it. scripts/ci/check-lockfile-overrides.py asserts both the header and, for every parent-scoped override, the resolved edge. It runs before the frozen install in check-lint, is stdlib-only so it needs nothing installed, and can only ADD a failure -- if it is buggy and passes, the frozen install behind it still refuses. Verified against #638's real lockfile: exit 1, naming both defects and the one-line fix. Separately, the override block was measured rather than assumed. Of its 10 entries, 9 do nothing: - uuid and dompurify override packages ABSENT from the tree entirely. - 7 more are already satisfied by natural resolution -- fast-xml-parser 5.11.1, fast-xml-builder 1.3.1, vite 8.3.0, esbuild 0.28.2, yaml 2.8.3/2.9.1, brace-expansion 5.0.12, fast-uri 3.1.8 -- every one at or above its floor. They were point-in-time CVE pins and upstream caught up. Only `satori>fflate` still does work, and it cannot go: satori pins `fflate: 0.7.3` exactly (not a range) in both 0.33.4 and latest 0.33.5, and that version carries GHSA-px8p-9vwx-vf98. Resolved the tree three ways to confirm every security floor still holds with the other nine gone. This does NOT close #540 -- one override remains, so the header remains, so the bot will still drop it. It shrinks the surface the bot can silently re-resolve from 10 pins to 1, and makes the failure self-documenting. Panel vote on the mechanism: 6-1 for fail-loud over a write-capable auto-repair workflow, which would have put `contents: write` on a branch this repo does not author -- the shape #495 removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015AvTumDxQ2ntLDwsSefHtf
williamzujkowski
added a commit
that referenced
this pull request
Sep 24, 2026
… that don't (#639) Dependabot's npm PRs have failed every required check since at least September 12 (#540, upstream dependabot/dependabot-core#16232). Open PR #638 is the fourth. It loses overrides two ways, and only one of them says so. The loud half: the bot drops the lockfile's `overrides:` header, so `pnpm install --frozen-lockfile` refuses with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. That message names neither the cause nor the fix, which is why this was diagnosed from scratch more than once -- and got it wrong the first time (#533, disproved 3m43s later by #537). The silent half: the bot also re-resolves parent-scoped overrides. On #638's lockfile `satori@0.33.4` is back on `fflate: 0.7.3`, reopening GHSA-px8p-9vwx-vf98. Nothing in CI could see this. Two cheaper checks were tried against #638's actual lockfile and both pass it, which is why the new check reads the resolved graph: - `grep -q '^overrides:'` passes on a lockfile whose header was restored by hand while the resolution stayed regressed. That is precisely what #540 warns against: "Do not repair only the header." - "is fflate@0.7.5 present?" passes too, because @shuding/opentype.js depends on 0.7.5 independently. The patched version being in the tree says nothing about whether SATORI uses it. scripts/ci/check-lockfile-overrides.py asserts both the header and, for every parent-scoped override, the resolved edge. It runs before the frozen install in check-lint, is stdlib-only so it needs nothing installed, and can only ADD a failure -- if it is buggy and passes, the frozen install behind it still refuses. Verified against #638's real lockfile: exit 1, naming both defects and the one-line fix. Separately, the override block was measured rather than assumed. Of its 10 entries, 9 do nothing: - uuid and dompurify override packages ABSENT from the tree entirely. - 7 more are already satisfied by natural resolution -- fast-xml-parser 5.11.1, fast-xml-builder 1.3.1, vite 8.3.0, esbuild 0.28.2, yaml 2.8.3/2.9.1, brace-expansion 5.0.12, fast-uri 3.1.8 -- every one at or above its floor. They were point-in-time CVE pins and upstream caught up. Only `satori>fflate` still does work, and it cannot go: satori pins `fflate: 0.7.3` exactly (not a range) in both 0.33.4 and latest 0.33.5, and that version carries GHSA-px8p-9vwx-vf98. Resolved the tree three ways to confirm every security floor still holds with the other nine gone. This does NOT close #540 -- one override remains, so the header remains, so the bot will still drop it. It shrinks the surface the bot can silently re-resolve from 10 pins to 1, and makes the failure self-documenting. Panel vote on the mechanism: 6-1 for fail-loud over a write-capable auto-repair workflow, which would have put `contents: write` on a branch this repo does not author -- the shape #495 removed. Claude-Session: https://claude.ai/code/session_015AvTumDxQ2ntLDwsSefHtf Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/astro-site/minor-and-patch-d466977b4b
branch
from
September 24, 2026 04:19
477fd50 to
ddb4c95
Compare
This was referenced Sep 24, 2026
… updates Bumps the minor-and-patch group with 7 updates in the /astro-site directory: | Package | From | To | | --- | --- | --- | | [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.3.0` | `7.3.1` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.1` | `7.3.3` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.1` | `15.0.2` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.0` | `5.57.1` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.69.0` | `8.70.0` | | [eslint](https://github.com/eslint/eslint) | `10.10.0` | `10.11.0` | | [eslint-plugin-astro](https://github.com/ota-meshi/eslint-plugin-astro) | `3.1.0` | `3.2.1` | Updates `@astrojs/markdown-remark` from 7.3.0 to 7.3.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.3.1/packages/markdown/remark) Updates `astro` from 7.3.1 to 7.3.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.3/packages/astro) Updates `markdown-it` from 15.0.1 to 15.0.2 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@15.0.1...15.0.2) Updates `svelte` from 5.57.0 to 5.57.1 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.1/packages/svelte) Updates `@typescript-eslint/parser` from 8.69.0 to 8.70.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/parser) Updates `eslint` from 10.10.0 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.10.0...v10.11.0) Updates `eslint-plugin-astro` from 3.1.0 to 3.2.1 - [Release notes](https://github.com/ota-meshi/eslint-plugin-astro/releases) - [Changelog](https://github.com/ota-meshi/eslint-plugin-astro/blob/main/CHANGELOG.md) - [Commits](ota-meshi/eslint-plugin-astro@v3.1.0...v3.2.1) --- updated-dependencies: - dependency-name: "@astrojs/markdown-remark" dependency-version: 7.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@typescript-eslint/parser" dependency-version: 8.70.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: astro dependency-version: 7.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: eslint-plugin-astro dependency-version: 3.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: markdown-it dependency-version: 15.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: svelte dependency-version: 5.57.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/astro-site/minor-and-patch-d466977b4b
branch
from
September 24, 2026 04:24
ddb4c95 to
c1c4545
Compare
williamzujkowski
added a commit
that referenced
this pull request
Sep 24, 2026
Applies the seven dependency bumps from #638 on top of current main and regenerates pnpm-lock.yaml natively, which is the workaround #540 documents. The bot's own lockfile could not be used as-is: it dropped the `overrides:` header AND re-resolved satori to the vulnerable fflate 0.7.3 (GHSA-px8p-9vwx-vf98). Per #540's standing instruction -- "Do not repair only the header: regenerate and inspect the resolved graph" -- the resolved graph was inspected rather than assumed. fflate@0.7.3 is absent from the tree entirely; satori@0.33.4 resolves fflate 0.7.5. scripts/ci/check-lockfile-overrides.py (added in #639) passes, and it is the check that rejects the bot's version of this same lockfile. @astrojs/markdown-remark ^7.3.0 -> ^7.3.1 astro ^7.3.1 -> ^7.3.3 markdown-it ^15.0.1 -> ^15.0.2 svelte ^5.57.0 -> ^5.57.1 @typescript-eslint/parser ^8.69.0 -> ^8.70.0 eslint ^10.10.0 -> ^10.11.0 eslint-plugin-astro ^3.1.0 -> ^3.2.1 frozen install clean, build 0, astro check 0 errors, eslint 0 errors, 5/5 design audits, 48/48 unit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015AvTumDxQ2ntLDwsSefHtf
williamzujkowski
added a commit
that referenced
this pull request
Sep 24, 2026
) Applies the seven dependency bumps from #638 on top of current main and regenerates pnpm-lock.yaml natively, which is the workaround #540 documents. The bot's own lockfile could not be used as-is: it dropped the `overrides:` header AND re-resolved satori to the vulnerable fflate 0.7.3 (GHSA-px8p-9vwx-vf98). Per #540's standing instruction -- "Do not repair only the header: regenerate and inspect the resolved graph" -- the resolved graph was inspected rather than assumed. fflate@0.7.3 is absent from the tree entirely; satori@0.33.4 resolves fflate 0.7.5. scripts/ci/check-lockfile-overrides.py (added in #639) passes, and it is the check that rejects the bot's version of this same lockfile. @astrojs/markdown-remark ^7.3.0 -> ^7.3.1 astro ^7.3.1 -> ^7.3.3 markdown-it ^15.0.1 -> ^15.0.2 svelte ^5.57.0 -> ^5.57.1 @typescript-eslint/parser ^8.69.0 -> ^8.70.0 eslint ^10.10.0 -> ^10.11.0 eslint-plugin-astro ^3.1.0 -> ^3.2.1 frozen install clean, build 0, astro check 0 errors, eslint 0 errors, 5/5 design audits, 48/48 unit. Claude-Session: https://claude.ai/code/session_015AvTumDxQ2ntLDwsSefHtf Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/astro-site/minor-and-patch-d466977b4b
branch
September 24, 2026 04:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the minor-and-patch group with 7 updates in the /astro-site directory:
7.3.07.3.17.3.17.3.315.0.115.0.25.57.05.57.18.69.08.70.010.10.010.11.03.1.03.2.1Updates
@astrojs/markdown-remarkfrom 7.3.0 to 7.3.1Release notes
Sourced from @astrojs/markdown-remark's releases.
Changelog
Sourced from @astrojs/markdown-remark's changelog.
Commits
aa4949e[ci] release (#17915)a548223Only treat literal script/style content as raw in MDX rendering (#17896)Updates
astrofrom 7.3.1 to 7.3.3Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
8a3106e[ci] release (#17939)5efea1bAdd a version field to the astro-client-only fixture80f9f1dHash compiled CSS output in incremental build to detect Sass partial changes ...bc6572fRevert "Forward user class to Picture's outer element" (#18004) (#18030)0e5478dNormalize CRLF line endings before computing CSP hashes (#17998)30ef3cbfix: invalidate prerender environment in invalidateDataStore (#17991) (#17999)312ab49Fix redirect targets when a param value contains a$replacement pattern (#...1b5a234Fix trailing-slash redirect body to match the Location header target (#18018)558b301Fix prerendered Cloudflare pages rendering as [object Object] with nodejs_com...4464b3afix(assets): forward class to picture element in Picture component (#18003) (...Updates
markdown-itfrom 15.0.1 to 15.0.2Changelog
Sourced from markdown-it's changelog.
Commits
3c5199115.0.2 releasedcf27366Polish #1209 and limit smartquotes stack to 1000 openers1b379c1Fix quadratic complexity in smartquotes rule when quote types don't match (#1...Updates
sveltefrom 5.57.0 to 5.57.1Release notes
Sourced from svelte's releases.
Changelog
Sourced from svelte's changelog.
Commits
636eaaaVersion Packages (#18750)8030ff2fix: remove incorrect special handling of :export pseudo-selectors (#18839)a72dc8efix: make Object.hasOwn reactive for state proxies (#18838)6eb720achore: scope.js stops importing from the analysis visitors (#18787)e6ae460chore: analysis and transform stop importing each other (#18786)5981c06chore: move parser helpers next to their users (#18785)f2ad10efix: preserve global CSS without scopable elements (#18793)a8a9b02fix: reduce SSR render result garbage collection (#18798)6be176dfix: resolve the fallback of an each block in the enclosing scope (#18803)34b13acfix: keep$state.eagerwhen used as a variable initializer (#18809)Updates
@typescript-eslint/parserfrom 8.69.0 to 8.70.0Release notes
Sourced from @typescript-eslint/parser's releases.
Changelog
Sourced from @typescript-eslint/parser's changelog.
Commits
7ee7608chore(release): publish 8.70.0Updates
eslintfrom 10.10.0 to 10.11.0Release notes
Sourced from eslint's releases.
Commits
3c0b7c610.11.0321f0a7Build: changelog update for 10.11.0520dd77perf: Implement fast paths in critical areas (#21210)9ecfdc5docs: note that --cache can serve stale results for cross-file rules (#21312)92086c8test: updateEMFILEerror generation for Node.js 26.9.0 compatibility (#21330)9ac7eb6chore: update github/codeql-action action to v4.38.0 (#21331)22b09f5fix: ignore__proto__properties inprefer-object-spread(#21311)24310e3chore: update ecosystem plugins (#21324)d136fa4feat: object-shorthand handle quoted properties forignoreConstructors(#21...45ad79eci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)Updates
eslint-plugin-astrofrom 3.1.0 to 3.2.1Release notes
Sourced from eslint-plugin-astro's releases.
Changelog
Sourced from eslint-plugin-astro's changelog.
Commits
1cfdc01Version Packages (#638)75f20e9chore(deps): update dependency@astrojs/mdxto v8 (#632)2ecb3bdfix: support postcss-load-config v4+ by running PostCSS in a worker (#639)bd55613chore(deps): update dependency prettier-plugin-astro to v1 (#636)830840cchore(deps): update dependency postcss-nested to v8 (#611)46b831fVersion Packages (#637)f3187f7feat: add support for eslint-plugin-jsx-a11y-x (#629)f974955chore(deps): update dependency@astrojs/markdown-satterito v0.4.1 (#635)5d02283chore(deps): update changesets/action action to v2.1.2 (#634)03bc808chore(deps): update dependency tsdown to ^0.23.0 (#633)