Skip to content

chore: resolve open dependabot security alerts - #66

Open
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts
Open

chore: resolve open dependabot security alerts#66
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

Copy link
Copy Markdown
Member

Summary

  • Resolved 4 open Dependabot security alerts by bumping vulnerable dependencies via yarn resolutions

Dependabot Alerts Resolved

Alert Package Severity Fix
#75 js-yaml high Bumped resolution to >=3.15.1 <4 (was >=3.15.0 <4)
#74 undici medium Bumped resolution to >=6.28.0 <7 (was >=6.27.0 <7)
#73 undici medium Bumped resolution to >=6.28.0 <7 (was >=6.27.0 <7)
#72 undici medium Bumped resolution to >=6.28.0 <7 (was >=6.27.0 <7)

- js-yaml 3.15.0 -> 3.15.1 (high, alert #75)
- undici 6.27.0 -> 6.28.0 (medium, alert #74)
- undici 6.27.0 -> 6.28.0 (medium, alert #73)
- undici 6.27.0 -> 6.28.0 (medium, alert #72)
Copilot AI lite review requested due to automatic review settings August 12, 2026 13:21
@jonathannorris
jonathannorris requested a review from a team as a code owner August 12, 2026 13:21

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates dependency resolutions to remediate Dependabot security alerts, and refreshes the bundled action output so the patched transitive code is what actually ships in dist/.

Changes:

  • Bump js-yaml resolution from >=3.15.0 <4 to >=3.15.1 <4.
  • Bump undici resolution from >=6.27.0 <7 to >=6.28.0 <7.
  • Regenerate/update dist/index.js bundle to incorporate the updated dependency code.

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated no comments.

File Description
package.json Updates Yarn resolutions to force patched versions for flagged transitive dependencies.
yarn.lock Locks updated resolved versions/checksums for js-yaml and undici.
dist/index.js Updates the bundled runtime output (including undici-related code paths) to reflect the bumped resolutions.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@jonathannorris
jonathannorris enabled auto-merge (squash) August 12, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants