Skip to content

fix(deps): bump ui transitive deps for open Dependabot alerts - #582

Merged
dkackman merged 1 commit into
developfrom
fix/dependabot-ui-deps
Oct 3, 2026
Merged

dkackman merged 1 commit into
developfrom
fix/dependabot-ui-deps

Conversation

@dkackman

@dkackman dkackman commented Oct 3, 2026

Copy link
Copy Markdown
Owner

Only ui/package-lock.json changes. Each new version is within the range its parent package already allows:

Package Via Change Alerts
devalue svelte 5.9.2 → 5.9.4 90–95
dompurify monaco-editor 3.4.15 → 3.4.16 89
brace-expansion eslint → minimatch 5.0.9 → 5.0.12 88
undici jsdom 8.10.1 → 8.11.2 76–85

This covers the same undici bump as #567 (which targets master).

Test plan

  • npm audit: 0 vulnerabilities
  • npm run check, npm run lint, npm test (474 passed), npm run build

🤖 Generated with Claude Code

Lockfile-only, within each parent's existing range:
- devalue 5.9.2 -> 5.9.4 (svelte) - alerts 90-95
- dompurify 3.4.15 -> 3.4.16 (monaco-editor) - alert 89
- brace-expansion 5.0.9 -> 5.0.12 (eslint/minimatch) - alert 88
- undici 8.10.1 -> 8.11.2 (jsdom) - alerts 76-85

npm audit: 0 vulnerabilities. svelte-check, eslint, vitest (474) and
the build pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dkackman
dkackman merged commit 2737c73 into develop Oct 3, 2026
5 of 7 checks passed
@dkackman
dkackman deleted the fix/dependabot-ui-deps branch October 3, 2026 03:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant