CHORE: Upgrade vulnerable transitive npm dependencies to clear open Dependabot alerts - #224
Open
jwrosewell wants to merge 1 commit into
Open
CHORE: Upgrade vulnerable transitive npm dependencies to clear open Dependabot alerts#224jwrosewell wants to merge 1 commit into
jwrosewell wants to merge 1 commit into
Conversation
Resolves the 8 open Dependabot alerts on ci/package-lock.json and pattern-library/package-lock.json by moving brace-expansion, postcss and immutable to patched versions within their existing semver ranges. Also bumps ws to clear an npm audit finding. Lock file only, no package.json changes needed. Progresses #140
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #140
What this does
When #140 was opened there were 94 open Dependabot alerts, almost all against the old Pattern Lab and gulp toolchain. That toolchain has since been replaced with Vite and Storybook, which resolved 86 of them. This PR clears the remaining 8 open alerts, which all sit in transitive npm dependencies in
ci/package-lock.jsonandpattern-library/package-lock.json.Every patched version was already inside the semver range the lock files allow, so the changes are lock file only with no
package.jsonedits and no major version moves.Packages upgraded
The
wsbump is not one of the 8 open Dependabot alerts. It was flagged bynpm auditwhile making the other changes and was fixable in the same in-range way, so it is included here.Alerts not addressed
None. All 8 open Dependabot alerts are covered by the upgrades above. The alerts themselves will close once this lands on
mainand Dependabot rescans the lock files.Verification
npm cifrom the updated lock file inpattern-library/followed bynpm run build:csscompletes successfully and produces all the minified CSS and JS outputs.npm cifrom the updated lock file inci/completes successfully and thecsso,purgecssandtersermodules all load.npm auditreports 0 vulnerabilities in both directories.Note
This PR was produced with AI assistance as part of a 5th August 2026 housekeeping sweep and needs human review before merge.