Repository navigation
chore(deps): track npm as a direct release tooling dependency - #6
Merged
Merged
Conversation
issue-agent.yml starts the agent on every opened issue and new comment by a maintainer: it decides, implements on a branch of termun/core-ts main until lint, tests and build pass, and opens a pull request to termun/core-ts. upstream-release.yml closes the issue once termun has merged and released it, and notifies the project that asked.
New high advisories on brace-expansion, fast-uri, js-yaml and markdown-it made the Dependency Safety job fail, on termun/core-ts main as well.
Actions: setup-node 7.1.0, upload-artifact 7.0.2, download-artifact 8.0.2, deploy-pages 5.0.1. Dependencies: @inquirer/core 12, dotenv 18; dev: @types/node 26, tsdown 0.23, the rest within range, and npm audit fix for the high advisories (brace-expansion, fast-uri, js-yaml, markdown-it). TypeScript stays on 6: typescript-eslint and typedoc do not support 7 yet.
npm update and npm audit fix in .github/release-tools clear the critical handlebars and the high js-yaml, brace-expansion and ip-address advisories, moving the npm bundled by @semantic-release/npm to 11.21.2. The moderate glob and minimatch advisories remain inside the latest npm 11 bundle.
Dependabot only bumps direct dependencies, so the npm bundled through @semantic-release/npm never moved on its own. Listing npm in the same range keeps a single copy and lets the weekly Dependabot run pick up the npm release that bundles the fixed glob and minimatch. The README describes the current advisories.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The remaining release tooling advisories (
glob13.0.6 andminimatch10.2.5, bundled innpm) wait for annpmrelease that bundles the fixed versions. Dependabot only bumps direct dependencies, so it would never move thenpmthat comes in through@semantic-release/npmand reports "cannot update glob to a non-vulnerable version".npm^11.21.2is now a direct dependency of.github/release-tools, in the range@semantic-release/npmaccepts:npm ls npmshows a single copy (the plugin's isdeduped)./.github/release-toolswill open a pull request as soon asnpmpublishes a new release; when it bundlesglob >= 14.0.2andminimatch >= 11.0.1, the alerts close.README.mdof the folder describes the current advisories and whynpmis listed.Checks
npm ci --prefix .github/release-tools,npm ls npmnpm run style:dry,npm testvia the CI of this PRNotes
None.
Generated by Claude Code