Skip to content

fix: resolve 47 Dependabot alerts via lockfile updates and vite 6 in boilerplates - #739

Merged
michielvandergeest merged 3 commits into
devfrom
fix/dependabot-highs
Sep 17, 2026
Merged

michielvandergeest merged 3 commits into
devfrom
fix/dependabot-highs

Conversation

@wouterlucas

Copy link
Copy Markdown
Contributor

Resolves all 47 open Dependabot alerts (27 high, 18 medium, 2 low).

  • Root + packages/create-blits locks: npm update (brace-expansion 1.1.18, picomatch 2.3.2, flatted 3.4.4, js-yaml 4.3.2, ws 8.21.3, form-data 4.0.6, yaml 2.9.0/1.10.3, minimatch 3.1.5, diff 8.0.4, ajv 6.15.0, browserslist 4.28.8). No overrides needed — all fixed within existing semver ranges. Verified each version OSV-clean.
  • Boilerplates (js/common, ts/common, ts/blits): vite ^5.4.8 -> ^6.4.3 (vite 5.x unfixable for GHSA-fx2h/4w7w/v6wh per OSV; 6.4.3 clean).

Verified: full tape suite 1370/1370 pass.

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

Test Results: ✅ PASSED

Run at: 2026-09-04T10:46:55.191Z

Summary:
passed: 1370 failed: 0 of 1370 tests

@michielvandergeest
michielvandergeest changed the base branch from master to dev September 17, 2026 07:52

@michielvandergeest michielvandergeest left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@michielvandergeest
michielvandergeest merged commit 23943c4 into dev Sep 17, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants