fix: resolve open dependabot security alerts#974
Conversation
There was a problem hiding this comment.
Pull request overview
Resolves Dependabot security alerts by forcing patched versions of vulnerable transitive dependencies using Yarn resolutions.
Changes:
- Add Yarn
resolutionsto pindompurifyto3.4.0andfollow-redirectsto1.16.0. - Regenerate
yarn.lockto reflect the new resolved versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Adds/updates resolutions entries to force patched dependency versions. |
| yarn.lock | Updates locked versions/checksums for dompurify and follow-redirects based on the new resolutions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Deploying devcycle-docs with
|
| Latest commit: |
1c50334
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://407a94d4.devcycle-docs.pages.dev |
| Branch Preview URL: | https://fix-dependabot-alerts-c2en.devcycle-docs.pages.dev |
Match the version range style used by parent packages per dependency resolution best practices.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- fast-xml-parser ^5.5.7 -> ^5.7.0 (medium, alert #179)
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
Resolved 7 open Dependabot security alerts by bumping vulnerable transitive dependencies via yarn resolutions.
Resolutions use minimum-version ranges (e.g. `^3.4.0`) rather than exact pins — the lockfile resolves to a specific version, while the range sets a security floor allowing future patch updates without another PR.
Dependabot Alerts Resolved