Consolidate Dependabot security updates - #784
Open
Giulia Stocco (gfs) wants to merge 2 commits into
Open
Giulia Stocco (gfs) wants to merge 2 commits into
Giulia Stocco (gfs) wants to merge 2 commits into
Conversation
Apply the five open Dependabot npm updates, fix the remaining qs audit finding, and make security groups catch all updates without the wildcard pattern that Dependabot can ignore. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Record the version produced when this pull request is squash-merged as one commit on main. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the five open Dependabot pull requests into one dependency update and fixes the remaining npm audit finding.
Dependency updates
brace-expansion1.1.16 → 1.1.18brace-expansion5.0.8 → 5.0.9fast-uri3.1.4 → 3.1.7@humanfs/node0.16.7 → 0.16.8js-yaml4.3.0 → 4.3.2Together these resolve all nine Dependabot alerts currently open on
main. Runningnpm audit fixalso found and upgradedqs6.15.2 → 6.16.0, clearing the remaining moderate npm audit finding.Dependabot grouping
Removes
patterns: ["*"]from each catch-all security-update group. Dependabot can incorrectly treat that wildcard as matching no dependencies and then fall back to independent PRs (dependabot/dependabot-core#13919). With no additional selector, every security update in the ecosystem matches its single security group.Regular version updates remain consolidated in the existing cross-ecosystem weekly PR. Security updates remain ecosystem-specific because Dependabot does not support adding them to a multi-ecosystem group; all current alerts are npm updates and will therefore be handled in one grouped PR.
Verification
npm ciinDevSkim-VSCode-Plugin/andDevSkim-VSCode-Plugin/client/npm audit --audit-level=lowin both directories: 0 vulnerabilitiesnpm run compilenpm run lintnpm run esbuild-baseThe changelog records version
1.0.99, the Nerdbank.GitVersioning version produced when this PR is squash-merged as one commit onto the currentmain.