Update build tooling to clear the open dependency advisories - #47
Merged
Conversation
GitHub flags 19 advisories against pnpm-lock.yaml and src-tauri/Cargo.lock. Everything on the npm side is bundler or test tooling that never ships in the app (the Vite toolchain, Babel for the React plugin, undici via jsdom); on the Rust side serde_with is the config (de)serializer under tauri-utils. npm, via an in-range `pnpm update` (package.json ranges left as they were): undici 7.25.0 -> 7.29.0 (11 advisories; via jsdom) vite 7.3.3 -> 7.3.6 (2 advisories) postcss 8.5.15 -> 8.5.26 (2 advisories; via vite) esbuild 0.27.7 -> 0.28.2 (1 advisory; vite 7.3.6 accepts ^0.28) @babel/core 7.29.0 -> 7.29.7 (1 advisory; via @vitejs/plugin-react) The same refresh moves the rest of the tree to its latest in-range releases (react 19.2.8, vitest 4.1.11, tailwindcss 4.3.3, the Radix primitives, @tauri-apps/api 2.11.1, @tauri-apps/cli 2.11.4, lucide-react 1.37.0, ...). No major versions are crossed. @testing-library/jest-dom is held at ~6.9.1: the registry deprecates 6.10.0 as a mis-published minor with breaking changes (Node >= 22, a new peer dependency) and points 6.x users back to 6.9.1. cargo: serde_with 3.20.0 -> 3.22.0 (1 advisory; via tauri-utils) The jiff/defmt/portable-atomic entries that appear in Cargo.lock are optional integrations of serde_with 3.22 that the resolver records; none of them is compiled into the app. Still open: glib 0.18.5 (1 advisory, Linux only, fixed in 0.20). tauri 2.x depends on gtk ^0.18 and the gtk3 bindings ended at 0.18.2, which pins glib to 0.18. Reaching 0.20 needs a Tauri release that drops gtk3, i.e. a major bump, so it stays as is for now. Verified: tsc --noEmit clean, vitest 83/83, vite production build, cargo test --lib 39/39, pnpm audit clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears 18 of the 19 Dependabot advisories GitHub reports against
mainwith in-range dependency refreshes. Everything on the npm side is build or test tooling that never ships in the app (the Vite toolchain, Babel for the React plugin, undici via jsdom); on the Rust sideserde_withis the config (de)serializer undertauri-utils.What changed
pnpm updatewith package.json ranges left as they were; the rest of the tree moves to its latest in-range releases (react 19.2.8, vitest 4.1.11, tailwindcss 4.3.3, Radix primitives, @tauri-apps/api 2.11.1 / cli 2.11.4, lucide-react 1.37.0). No majors crossed.@testing-library/jest-dompinned to~6.9.1: the registry deprecates 6.10.0 as a mis-published minor with breaking changes.glib0.18.5 → 0.20 (medium, Linux-only GTK stack).tauri 2.xrequiresgtk ^0.18, whose last release pinsglib ^0.18; the gtk3-rs line has ended, so this waits for a Tauri release that moves off gtk3.cargo auditadditionally notesquick-xml0.39 (viaplist←tauri) — same situation.Test plan
pnpm exec tsc --noEmitclean;pnpm test83 passed;pnpm build(vite 7.3.6 production build) OKcargo test --lib39 passedpnpm audit: no known vulnerabilities;cargo auditoutput identical tomain(nothing introduced)