Skip to content

chore(deps): bump vulnerable dependencies (Dependabot security) - #918

Closed
Fletch153 wants to merge 1 commit into
mainfrom
chore/dependabot-security-bumps
Closed

Fletch153 wants to merge 1 commit into
mainfrom
chore/dependabot-security-bumps

Conversation

@Fletch153

@Fletch153 Fletch153 commented Oct 12, 2026 •

Copy link
Copy Markdown
Collaborator

Updates 13 dependencies with known security vulnerabilities to their fixed versions. Resolves 41 of 42 open Dependabot alerts.

Package Update Jira
fast-uri 3.1.2 → 3.1.8 DF-26109, DF-26113, DF-26321, DF-26720–26722, DF-27509
simple-git 3.27.0 → 4.0.2 DF-23671, DF-24214, DF-24594, DF-27506–27508
brace-expansion 1.1.11 → 1.1.21; 2.0.1 → 2.1.7; 5.0.5 → 5.0.12 DF-25994, DF-26008, DF-26086/87
minimatch 3.1.2 → 3.1.5; 5.1.6 → 5.1.9; 9.0.5 → 9.0.9 DF-23371, DF-23389/90, DF-23393
js-yaml 3.14.1 → 3.15.2 DF-26032, DF-26335, DF-26791
tar 7.5.14 → 7.5.22 —
lodash-es 4.17.23 → 4.18.1 DF-24044
find-my-way 9.6.0 → 9.10.0 DF-26118
@humanfs/node, fast-copy, markdown-it, picomatch → 0.16.8 / 4.1.2 / 14.3.2 / 2.3.2 —
  • No code changes — dependency versions only. The simple-git major update was verified compatible with how it's used (independent audit).
  • CI green. The generate-example-adapter check fails repo-wide due to an upstream package release, unrelated to this PR (suggested fix noted in comments).

@github-actions

github-actions Bot commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

NPM Publishing labels 🏷️

🔵 This PR has the none label set and it will not cause a version bump.

@Fletch153 Fletch153 added the none label Oct 12, 2026
@Fletch153
Fletch153 marked this pull request as ready for review October 12, 2026 15:04
@Fletch153
Fletch153 requested a review from a team as a code owner October 12, 2026 15:04
Resolves open Dependabot alerts; see PR #918 for the full package list.
@Fletch153
Fletch153 force-pushed the chore/dependabot-security-bumps branch from 01c3def to 50a4542 Compare October 13, 2026 11:22
@Fletch153

Copy link
Copy Markdown
Collaborator Author

Closing: this PR's bumps are all transitive (indirect) dependency updates. Team policy is now direct-dependency updates only; these alerts will be handled differently.

@Fletch153 Fletch153 closed this Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant