chore: Clear all open security advisories - #14
Merged
Merged
Conversation
Resolve the 4 high severity npm audit findings: - wrangler 4.125.0 -> 4.132.0, pulling in miniflare with sharp >= 0.35.4 (GHSA-rgj7-g3m4-5g8c, libheif vulnerabilities) - js-yaml 3.15.1 -> 3.15.2 under babel-jest (GHSA-2883-xcg3-v3hh, unbounded CPU use on empty merge sources) Lockfile only, no package.json range changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jest 27 pulled in an outdated jsdom chain (@tootallnate/once -> http-proxy-agent), which accounted for all 9 remaining low severity audit findings. Bump jest and babel-jest to v30 and add the now separately published jest-environment-jsdom. No config or test changes were needed; all 13 suites pass and npm audit reports 0 vulnerabilities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
배경
Dependabot이 열어둔 알림(#138, #139)과
npm audit결과(high 4 / low 9)를 확인하고 전부 해소했습니다.sharp< 0.35.4wrangler→miniflare→sharpjs-yaml3.15.1babel-jest하위jest27 계열@tootallnate/once→http-proxy-agent)변경 사항
chore: Bump sharp and js-yaml to fix high severity advisoriesnpm audit fix로 lockfile만 갱신 (package.jsonrange 변경 없음)wrangler4.125.0 → 4.132.0 (sharp0.35.4 포함),js-yaml3.15.1 → 3.15.2chore: Upgrade jest to v30 to clear remaining advisoriesjest/babel-jest27 → 30, jest 28부터 별도 배포된jest-environment-jsdom추가jest.config.cjs,babel.config.cjs, 테스트 코드 수정은 필요 없었습니다^18.14 || ^20 || >=22.11)을 충족합니다프로덕션 의존성은 건드리지 않았고, 전부 devDependencies 및 그 하위입니다.
검증
npm audit→ found 0 vulnerabilitiesnpm test→ 13 suites / 32 tests 통과npm run build→ 성공 (tsc + vite + service worker)🤖 Generated with Claude Code