chore(deps): resolve all open Dependabot alerts - #62
Merged
Conversation
Bump @wordpress/scripts 31.6.0 -> 33.0.0 and grunt-contrib-cssmin 0.12.3 -> 5.0.0, and add an overrides block pinning patched versions of the transitive build-time dependencies flagged by Dependabot. All 17 open alerts are in dev/build tooling (package-lock.json only); none reach the shipped plugin. Verified `npm run build:blocks` and the grunt default task (jshint, cssmin, wp_readme_to_markdown, makepot) both still succeed, and `npm audit` reports 0 vulnerabilities.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears all 17 open Dependabot alerts, every one of which is in dev/build-time tooling (
package-lock.jsononly) — none reach the shipped plugin (PHP + built block assets).What changed
@wordpress/scripts31.6.0 → 33.0.0 (latest) andgrunt-contrib-cssmin0.12.3 → 5.0.0.overridesblock pinning patched versions of transitive build deps. This is needed because even the latest@wordpress/scriptsstill declares older ranges for its bundled linters/dev-server (e.g.webpack-dev-server ^4.15.1,adm-zip ^0.5.9,markdownlint-cli ^0.31.1), so the alerts can only be cleared by forcing the fixed versions.Overrides are scoped where a package spans multiple major lines so safe consumers aren't dragged down:
js-yaml→ 3.15.0 only undergrunt(eslint's 4.3.0 is already patched).minimatch→ 3.1.5 only undermarkdownlint-cli/jshint/globule(9.x and 10.x elsewhere are unaffected).Alerts resolved
adm-zip, body-parser, brace-expansion (1.x + 2.x), http-proxy-middleware, shell-quote, js-yaml (3.x + 4.x), webpack-dev-server, markdown-it, linkify-it, @babel/core, @opentelemetry/core, plus the uuid/sockjs chain under webpack-dev-server.
Verification
npm audit→ 0 vulnerabilitiesnpm run build:blocks→ compiles successfullygrunt default(jshint, cssmin, wp_readme_to_markdown, makepot) → passesNote: all findings are DoS/ReDoS/prototype-pollution classes in build tooling that operate on trusted local inputs, so there was no runtime exposure in the distributed plugin — this just clears the alerts and keeps the toolchain current.