Repository navigation
chore(deps-dev): bump the npm group and clear high-severity audit advisories - #34
Merged
Merged
Conversation
…y with 9 updates Bumps the npm-minor-and-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@tsconfig/node20](https://github.com/tsconfig/bases/tree/HEAD/bases) | `20.1.9` | `20.1.10` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.3` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.11.0` | | [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` | | [playwright](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [temporal-polyfill](https://github.com/fullcalendar/temporal-polyfill/tree/HEAD/polyfill) | `1.0.3` | `1.0.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.15` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.71.0` | Updates `@tsconfig/node20` from 20.1.9 to 20.1.10 - [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases) Updates `@types/node` from 26.2.0 to 26.6.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `eslint` from 10.8.1 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.11.0) Updates `fast-check` from 4.9.0 to 4.10.2 - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check) Updates `playwright` from 1.62.1 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.62.1...v1.63.0) Updates `prettier` from 3.9.6 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.9) Updates `temporal-polyfill` from 1.0.3 to 1.0.5 - [Release notes](https://github.com/fullcalendar/temporal-polyfill/releases) - [Changelog](https://github.com/fullcalendar/temporal-polyfill/blob/main/polyfill/CHANGELOG.md) - [Commits](https://github.com/fullcalendar/temporal-polyfill/commits/temporal-polyfill@1.0.5/polyfill) Updates `tsx` from 4.23.12 to 4.23.15 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.12...v4.23.15) Updates `typescript-eslint` from 8.67.0 to 8.71.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@tsconfig/node20" dependency-version: 20.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: "@types/node" dependency-version: 26.6.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: fast-check dependency-version: 4.10.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: playwright dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: temporal-polyfill dependency-version: 1.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: tsx dependency-version: 4.23.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-and-patch - dependency-name: typescript-eslint dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
The daily audit has failed on main since 2026-09-30, and the same failure blocks the Dependabot group PR through the required CI check. Every advisory is in dev tooling, none ships in the package: - brace-expansion 1.1.21 / 5.0.12 (eslint, eslint-plugin-import) - source-map-js 1.2.2 (tsup > postcss) - markdown-it 14.3.2 (typedoc) - vitest 4.1.11, and raise the floor so the fix cannot regress One low advisory remains: esbuild 0.27.x under tsup, whose latest release still pins esbuild ^0.27.0. It concerns esbuild's serve mode, which tsup does not use, and it is below the high-severity gate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #32. Carries Dependabot's commit unchanged and adds one commit on top.
Why #32 was stuck
Its
auditjob failed, andauditis part ofCI (required check). The advisories are not caused by the bump: the scheduled audit onmainhas been red every day since 2026-09-30. Every one is in dev tooling, and none ships in the package.package.json)One low advisory remains: esbuild 0.27.x under tsup. tsup's latest release (8.5.1) still pins
esbuild ^0.27.0. The advisory concerns esbuild'sservemode, which tsup does not use, and it is below the--audit-level highgate.Even with green CI, #32 would not have merged by itself. It contains minor bumps, and only patch-only updates auto-merge. #33 covers that side.
Verification
pnpm audit --audit-level high: exits 0 (was 10 findings, 4 high)pnpm typecheck,pnpm lint,pnpm format:check,pnpm build: passpnpm test: 234 pass and 2 fail, both intest/live/cross-check.live.test.ts(composite and Davison, Sun off by 1.03e-6° against a 1e-6° tolerance). They fail identically onmain. They only run whenMORPHEMERIS_API_KEYis set, so CI skips them. They are unrelated to this change and have not been touched. They will be tracked separately.Manual test
git checkout fix/deps-audit-and-bump && pnpm installpnpm audit --audit-level highshould exit 0, with 1 low finding (esbuild) listed.pnpm testwithoutMORPHEMERIS_API_KEYin the environment: all pass.pnpm buildsucceeds.No user-facing surface: the lockfile and one dev-dependency floor change only. A
choretype, so release-please will not cut a release for it.🤖 Generated with Claude Code