chore(deps): apply security CVE bumps + minor/patch updates - #62
Conversation
pg-sveltekit: vite ^8.0.14 -> ^8.1.0 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3) pg-manual: webpack-dev-server ^5.2.4 -> ^5.2.5, pulling in ws >=8.21.0 (GHSA-96hv-2xvq-fx4p), http-proxy-middleware >=2.0.10 (GHSA-64mm-vxmg-q3vj), launch-editor >=2.14.1 (GHSA-v6wh-96g9-6wx3). npm audit reports 0 vulnerabilities in both sub-projects.
pg-sveltekit: @sveltejs/kit, svelte, svelte-check, typescript-eslint, eslint, eslint-plugin-svelte, prettier, prettier-plugin-svelte, globals. pg-manual: webpack, webpack-cli, @privacybydesign/yivi-popup. Excludes the two major bumps (@e4a/pg-js 1->2 runtime dep, @types/node 25->26) which the issue asks be handled in their own PRs. Builds, svelte-check, lint and npm audit all pass.
![dobby-coder[bot]](https://avatars.githubusercontent.com/in/3365457?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: APPROVE / sign-off — posted as
COMMENTonly because GitHub blocks a self-authored PR from submitting APPROVE. Treat as approved.
Rules Dobby 2 gatekeeper — signed off. No blocking issues.
Code/build review (Review Dobby 2) found 0 code or build defects, and the per-rule sweep is green. Confirmed:
- Both sub-projects build/check/lint clean;
npm auditreports 0 vulnerabilities in each. overrides.cookie ^0.7.2(pg-sveltekit) andoverrides.uuid ^11.1.1(pg-manual) pins preserved.- Transitive CVE fixes resolved as intended: ws 8.21.0, http-proxy-middleware 2.0.10, launch-editor 2.14.1; vite → 8.1.x.
- The two majors (
@e4a/pg-js1→2,@types/node25→26) correctly deferred to their own PRs.
Resolved during gatekeeping: the only rule gap was a missing reviewer (pr-review-assignments) — I assigned @rubenhensen (as issue #61 requested), so no fix loop is needed.
Non-blocking notes: combining the CVE + minor/patch bumps into one PR is acceptable here (dev-only deps on an example app, no independent-merge concern); Refs #61 correctly keeps the issue open to track the deferred majors. Flipping out of draft to ready-for-review.
1 participant
Dependency updates for #61
Resolves the security advisories flagged in #61 and applies the minor/patch batch of outdated packages. No CI build gate on this repo — please review manually.
Security bumps (applied first)
^8.0.14→^8.1.0^5.2.4→^5.2.5(resolved 5.2.6)The webpack-dev-server bump alone left the old
ws/http-proxy-middleware/launch-editorversions pinned in the lockfile;npm updateon those three pulled the fixed versions in-range (nooverridesneeded).npm auditnow reports 0 vulnerabilities in bothpg-sveltekitandpg-manual.Minor / patch batch
@sveltejs/kit,svelte,svelte-check,typescript-eslint,eslint,eslint-plugin-svelte,prettier,prettier-plugin-svelte,globalswebpack,webpack-cli,@privacybydesign/yivi-popupDeliberately deferred (own PRs, per the issue's worker instructions)
@e4a/pg-js1.10.0 → 2.1.0 (runtime dep, major — needs changelog review) inpg-sveltekit+pg-node@types/node25.x → 26.x (major) inpg-sveltekitKeeping #61 open to track these two remaining major bumps.
Verification
pg-sveltekit:npm install✓ ·npm run build✓ ·npm run check(0 errors / 0 warnings) ✓ ·npm run lint✓ ·npm audit0 vulns ✓pg-manual:npm install✓ ·npm run build(clean compile, no "export … was not found" warnings) ✓ ·npm audit0 vulns ✓Refs #61