Repository navigation
Chore/deps audit 2026 11 - #1
Merged
Merged
Conversation
Update the Angular toolchain (22.2.4, build 22.2.5, analog 2.9.5), vite ^8.3.5, jsdom ^30.1.3 and vue 3.5.44, and refresh adapter peer resolutions via a targeted dedupe. jsdom 30.1 brand-checks platform getters with private fields, so test proxies around computed styles now forward reads with the real style object as the receiver.
Update vitest group to 4.1.12 (@vitest/mocker), and refresh transitive fast-uri to 3.1.9 and brace-expansion to 1.1.21/5.0.12 within existing ranges.
Bump vite to 8.3.5 in all demo manifests and align Angular (22.2.4, build/cli 22.2.5), tslib 2.9.1, React 19.3.1, Vue 3.5.44 and wavesurfer.js 7.12.12 with the root workspace.
Bump prettier to 3.9.10, typescript-eslint to 8.72.1, globals to 17.14.0, stylelint to 17.16.0 and eslint-plugin-jsdoc to 64.5.4, and dedupe the @typescript-eslint subtree.
Bump playwright to 1.64.1, react/react-dom to 19.3.1, marked to 18.1.3, tslib to 2.9.1 and @types/node to 24.19.2, and dedupe the React adapter peer importer.
Run a one-time recursive update without changing specifiers, keeping rolldown and semver aligned with the exact pins of @angular/build, and dedupe the result.
Vitest 5 mutates the resolved Vite oxc options, so the Angular project's 'oxc: true' now crashes at startup; use an empty OxcOptions object. Replace a cross-realm toMatchObject in mountContext.test.ts with identity assertions: subset matching traversed the whole iframe Window graph and exceeded the default timeout under parallel load.
WaveSurfer 8 implements copyFromChannel/copyToChannel for predecoded peaks itself and no longer reads the global AudioBuffer prototype, so the compatibility shim for browsers without Web Audio is no longer needed.
Pin packageManager to pnpm@11.28.10 with its registry sha512. Apply the dedupe that pnpm 11.28.10 requires: the optional supports-color peer now resolves to the already-installed 8.1.1, dropping supports-color@10.2.2. No other package versions change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive dependency security and maintenance update across the Tracker monorepo and demo applications.
No changes to the published Tracker library API or package versions. No npm release is required.
Known remaining issues
minimatchadvisory remains in the development tooling. The affected code path was reviewed and is not reachable under the current ESLint configuration.@emnapi/*peer dependency warnings remain. Native bindings and the WASI fallback were verified to work; no compatibility overrides or warning suppressions were introduced.Related issue or discussion
Verification
The following checks were performed locally during the dependency update and confirmed successful:
pnpm install --frozen-lockfilepnpm format:checkpnpm typecheckpnpm eslintpnpm stylelintpnpm packages:metadata:checkpnpm packages:testpnpm packages:buildpnpm packages:verify:distpnpm packages:verify:packpnpm benchmarks:testpnpm packages:test:browser:chromiumpnpm packages:test:browser:firefoxpnpm packages:test:browser:webkitpnpm site:testpnpm site:build:devpnpm site:buildpnpm site:test:browser:chromiumAdditional verification:
pnpm-lock.yaml.pnpm dedupe --checkpasses.pnpm auditreports no critical or high vulnerabilities, with one documented moderate advisory remaining.GitHub Actions will provide the final CI verification for this PR.
Dependabot alerts are expected to close automatically after merging into the default branch and refreshing the dependency graph.
Checklist