Skip to content

fix(deps): clear all open dependabot alerts in the lockfile - #67

Open
rickstaa wants to merge 1 commit into
mainfrom
fix/dependabot-transitive-updates
Open

fix(deps): clear all open dependabot alerts in the lockfile#67
rickstaa wants to merge 1 commit into
mainfrom
fix/dependabot-transitive-updates

Conversation

@rickstaa

@rickstaa rickstaa commented Sep 8, 2026

Copy link
Copy Markdown
Member

Resolves all 12 open Dependabot alerts with lockfile-only changes. Bumps next to 15.5.25 (pulls sharp 0.35.4) and @eslint/eslintrc to 3.3.7 (pulls js-yaml 4.3.2), and refreshes brace-expansion and @humanfs/node. Adds pnpm overrides for postcss (^8.5.28, pinned exactly by next 15.5) and esbuild (^0.25 for the deprecated @esbuild-kit loader under drizzle-kit). pnpm audit is clean; build, lint, typecheck, tests, and a drizzle-kit smoke test all pass.

next 15.5 pins postcss 8.4.31 and drizzle-kit's deprecated esbuild-kit
loader pins esbuild 0.18, so neither moves without an override.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@rickstaa
rickstaa requested a review from adamsoffer as a code owner September 8, 2026 21:14
@vercel

vercel Bot commented Sep 8, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
console Ready Ready Preview Sep 8, 2026 9:16pm UTC

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant