fix: vulnerable dependencies in repo#11
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s Node.js tooling dependencies and lockfile to address vulnerable transitive packages, including forcing a patched @xmldom/xmldom version via pnpm overrides.
Changes:
- Bumps several dev tooling dependencies (Marp CLI, Vite, Vitest, Prettier, lint-staged, tar-fs, tsx) to newer patch/minor versions.
- Adds a pnpm override for
@xmldom/xmldomto enforce a non-vulnerable version. - Regenerates
pnpm-lock.yamlto reflect the new dependency graph and resolved versions.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| package.json | Updates devDependency versions and adds pnpm.overrides for @xmldom/xmldom. |
| pnpm-lock.yaml | Records updated resolutions/snapshots and the lockfile-level overrides entry. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "@marp-team/marp-cli": "^4.3.1", | ||
| "@types/node": "^24.10.1", | ||
| "husky": "^9.1.7", | ||
| "js-yaml": "^4.1.1", | ||
| "lint-staged": "^16.2.6", | ||
| "prettier": "^3.6.2", | ||
| "tar-fs": "^3.1.1", | ||
| "tsx": "^4.20.6", | ||
| "lint-staged": "^16.4.0", | ||
| "prettier": "^3.8.1", | ||
| "tar-fs": "^3.1.2", | ||
| "tsx": "^4.21.0", | ||
| "typescript": "^5.9.3", | ||
| "vite": "^8.0.0", | ||
| "vitest": "^4.1.0" | ||
| "vite": "^8.0.3", | ||
| "vitest": "^4.1.2" |
There was a problem hiding this comment.
The updated toolchain (notably vite@8.0.3 and lint-staged@16.4.0) has stricter Node.js engine requirements (vite requires >=20.19.0, lint-staged requires >=20.17). package.json currently doesn’t declare an engines.node range, so contributors/CI running an older Node 20.x patch can hit install/runtime failures. Consider adding an explicit "engines": {"node": ">=20.19.0"} (or whichever minimum you intend) and aligning CI/local tooling to that minimum.
| }, | ||
| "pnpm": { | ||
| "overrides": { | ||
| "@xmldom/xmldom": ">=0.9.9" |
There was a problem hiding this comment.
The pnpm override for @xmldom/xmldom is currently an open-ended range (">=0.9.9"), which would allow a future 1.x/major release to be pulled in via the override when the lockfile is refreshed. To reduce the chance of unexpected breaking changes, consider constraining the override (e.g., "^0.9.9" or ">=0.9.9 <1.0.0") while still enforcing the patched baseline.
| "@xmldom/xmldom": ">=0.9.9" | |
| "@xmldom/xmldom": ">=0.9.9 <1.0.0" |
No description provided.