Repository navigation
chore: Remediate 15 Dependabot security alerts (lockfile only) - #298
Merged
ernst-dev merged 1 commit intoNov 2, 2026
Merged
Conversation
Update undici, qs, serialize-javascript, follow-redirects and decode-uri-component to patched releases. All are dev dependencies.
pan-kot
approved these changes
Nov 2, 2026
ernst-dev
deleted the
dependabot-remediate/security-remediation-20261102
branch
November 2, 2026 14:09
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates 5 development dependencies to patched releases (lockfile only) to resolve 15 open security alerts.
Merging this PR is expected to resolve 15 of this repository's 17 open security alerts. The other 2 are listed under "Not resolved".
Alerts addressed
decode-uri-component, high, 0.5.0 -> 0.5.1follow-redirects, high, 1.16.0 -> 1.16.2follow-redirects, high, 1.16.0 -> 1.16.2follow-redirects, high, 1.16.0 -> 1.16.2qs, medium, 6.15.3 -> 6.17.1serialize-javascript, low, 7.1.0 -> 7.1.4undici, high, 6.29.0 -> 6.29.1undici, high, 7.30.0 -> 7.30.1undici, medium, 6.29.0 -> 6.29.1undici, medium, 7.30.0 -> 7.30.1undici, high, 6.29.0 -> 6.29.1undici, high, 7.30.0 -> 7.30.1undici, high, 6.29.0 -> 6.29.1undici, high, 7.30.0 -> 7.30.1undici, high, 7.30.0 -> 7.30.1How it was fixed
All five packages are transitive dependencies that npm can update within their existing parent ranges, so each was updated with
npm update <package> --package-lock-only.undiciappears twice in the lockfile, on two major lines, and each was updated within its own line (7.30.0 -> 7.30.1 and 6.29.0 -> 6.29.1), so neither crosses a major version.package.jsonis unchanged. The diff is limited to six entries inpackage-lock.json, all markeddev. Fourfast-urialerts that were open when this work started were resolved onmainin the meantime and are not part of this PR.Not resolved
deepmerge, low. No patched release has been published, so there is nothing to update to.minimatch, medium. The only patched release is 11.0.1 (a new major version). The vulnerable copies sit on older major lines pulled in by different parents, so no parent update reaches the fix. Resolving it would need apackage.jsonoverridesentry, which needs a maintainer decision.Why one pull request
The open alerts were grouped into a single PR to avoid a large number of separate dependency updates.
Verification
Run locally on this commit:
npm run buildpasses (Node 22). This repository has no unit tests, and its end-to-end tests drive a real browser, which could not run in the environment used to prepare this PR (the local browser driver does not match the installed Chrome version). Please rely on CI for those.