Repository navigation
chore(deps): fix dev-dependency security advisories - #282
Conversation
Lockfile-only upgrades via yarn up -R (all dev-scope): @babel/core 7.29.0->7.29.7 (low), baseline-browser-mapping ->2.11.32, brace-expansion ->1.1.21/2.1.7/5.0.12 (high), browserslist ->4.29.4 (high), compression ->1.8.2 (high), fast-uri ->3.1.9 (high), follow-redirects ->1.16.1 (high), http-proxy-middleware ->2.0.11, js-yaml ->3.15.2/4.3.2 (high), launch-editor ->2.14.2 (high), postcss ->8.5.31 (high), postcss-selector-parser ->7.1.7, proxy-addr ->2.0.8 (critical), qs ->6.15.3 (medium), shell-quote ->1.12.0 (critical), source-map-js ->1.2.2 (high), webpack-dev-server ->5.2.7, websocket-driver ->0.7.5 (critical), ws ->8.22.0 (high). One resolution added because no in-range fix exists: uuid ^11.1.1 (medium; sockjs pins ^8.3.2, unmaintained; dev-only), noted in package.json _resolutionNotes. All 48 alerts addressed; none left.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Add dependency resolution pin package.json |
The Yarn configuration pins uuid to ^11.1.1 and records a note about the advisory fix and the sockjs pin through webpack-dev-server. |
Estimated code review effort: 2 (Simple) | ~5 minutes
Change: Other
Possibly related PRs
- react-grid-layout/react-resizable#280: Establishes Yarn 4 and its lockfile workflow, which this PR uses for dependency maintenance.
Merge Risk: 
8986b
-
No merge-blocking risk is established for this dependency-resolution change.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: fixing security advisories in development dependencies. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Packj audit found 1/1 risky dependencies.
|
| Registry | Package | Version | Risks |
|---|---|---|---|
| npm | react-draggable | 4.5.0 |
|
Closes the 48 open Dependabot alerts with lockfile upgrades (
yarn up -R), among them brace-expansion 5.0.12, follow-redirects 1.16.1 and qs 6.15.3. All are dev-toolchain packages;dependenciesandpeerDependenciesdo not change.One
resolutionsentry is needed because no in-range fix exists, with its reason in_resolutionNotes:uuid ^11.1.1, since sockjs (via webpack-dev-server) pins^8.3.2and has had no release since.yarn install --immutableyarn testSummary by CodeRabbit