yasithdev opened a new pull request, #121: URL: https://github.com/apache/airavata-portals/pull/121
Regenerates three sub-project lockfiles on current `main` to land Dependabot security bumps that became conflicted after their sibling bumps merged. Each was reproduced with `npm ... --package-lock-only` (lockfile-only, no manifest/API changes), landing at the latest in-range version (>= Dependabot's target). | Package | Project | Version | Supersedes | |---|---|---|---| | node-forge | airavata-local-agent | 1.3.1 -> 1.4.0 | #69 | | elliptic | airavata-mft-portal/static/common | 6.5.2 -> 6.6.1 | #81 (partial) | | webpack | airavata-mcp-client-chatbot/widget | 5.99.9 -> 5.107.2 | #96 | | react-router(-dom) | airavata-mcp-client-chatbot/widget | 7.7.0 -> 7.17.0 | #80 | | jsonpath | airavata-mcp-client-chatbot/widget | 1.1.1 -> 1.3.0 | #94 | | js-yaml | airavata-mcp-client-chatbot/widget | 3.14.1 -> 3.14.2 | #64 | | mdast-util-to-hast | airavata-mcp-client-chatbot/widget | 13.2.0 -> 13.2.1 | #70 | Note: the @vue/cli v4->v5 toolchain portion of #81 is intentionally excluded — it needs eslint >= 7.5.0 and a build verification, so #81 stays open for that. Test plan: lockfile-only changes; no manifest or source changes. Repo has no CI; not build-verified locally. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
