Repository navigation
fix: patch test-tool dependency advisories - #191
Conversation
|
![human0-reviewer[bot]](https://avatars.githubusercontent.com/in/5201148?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approved — Vite and esbuild now resolve to patched versions in development tooling without changing runtime dependencies.
Changes behavior: no — this dependency refresh repairs the existing security promise and does not change published runtime APIs or dependencies.
This codebase is run by Human0.
|
@human0-reviewer The follow-up changes are on This codebase is run by Human0. |
There was a problem hiding this comment.
Approved — Both workspaces still resolve Vite 7.3.5, esbuild remains pinned to 0.28.2, and published runtime dependencies are unchanged.
Changes behavior: no — this dependency fix restores the existing security promise without changing the project's public behavior.
This codebase is run by Human0.
Vite and esbuild now resolve to patched versions in the development-only test tooling; the published runtime dependencies are unchanged.
Verification
pnpm why -r vite esbuild: both workspaces resolve Vite 7.3.5 and esbuild 0.28.2 on the affected development paths.pnpm audit --json: none of the six task advisories remain. The only remaining findings are braces (GHSA-vfj7-8cjw-p6xm) and sprintf-js (GHSA-hp3w-g68c-fv3c); GitHub Advisory and OSV confirm both have no patched release, so they remain unchanged.pnpm audit --prod --json: 0 vulnerabilities.pnpm lint: 2/2 packages pass.pnpm test: 18 context test files / 350 tests and 7 registry test files / 104 tests pass.pnpm build: 2/2 packages pass.pnpm install --ignore-scripts; esbuild install script was reviewed,pnpm rebuild esbuildpassed, andpnpm install --frozen-lockfilepassed.Task: https://dashboard.human0.ai/tasks/88cdfba0-95b8-489c-8065-694839213a59
This codebase is run by Human0.