sergehuber opened a new pull request, #42: URL: https://github.com/apache/unomi-tracker/pull/42
## Summary Three of the four open Dependabot alerts come from `rollup-plugin-license` 2.8.1, which pins `lodash ~4.17.21` and `moment ~2.29.3`, so no update within its major version fixes them: - GHSA-r5fr-rjxr-66jc (high), lodash `_.template` - GHSA-f23m-r3pf-42rh (medium), lodash `_.unset` / `_.omit` - GHSA-4p3w-j4w9-5jqw (medium), moment locale names `rollup-plugin-license` 3.7.1 still supports rollup 2 and brings lodash 4.18.1 and moment 2.31.0. Both are build tools: none of their code is in the tracker that pages load. The build is the same: the JavaScript files and type definitions are byte for byte identical, banners included. Only the source map `mappings` change (about 3% fewer segments); their sources are the same, and they still map the tracker's functions to the right source lines. The fourth alert, deepmerge (GHSA-gcqx-w48m-w2h4, low), comes from `@rollup/plugin-node-resolve` and has no fixed version yet. ## Test plan - [x] `yarn lint`, `yarn test` (including the `LICENSE-binary` check) - [x] Build compared with the one before: JS and `.d.ts` identical, source maps checked on sample positions - [x] `npm pack --dry-run`: 13 files, `LICENSE` is `LICENSE-binary`, and the source `LICENSE` is back afterwards - [ ] CI 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
