LiteSun opened a new pull request, #3475: URL: https://github.com/apache/apisix-dashboard/pull/3475
Please answer these questions before submitting a pull request, **or your PR will get closed**. **Why submit this pull request?** - [x] Bugfix - [ ] New feature provided - [ ] Improve performance - [ ] Backport patches **What changes will this PR take into?** Resolves every open npm Dependabot security alert on `master` (51 alerts) and all but one `pnpm audit` finding (82 → 1). The one left is `braces` 3.0.3 (GHSA-vfj7-8cjw-p6xm), pulled in by `@tanstack/router-plugin > chokidar@3`, which has no patched release yet. Direct dependencies (all stay on their current major): | Package | Before | After | | --- | --- | --- | | axios | ^1.15.2 | ^1.20.0 (also pulls form-data 4.0.6) | | nanoid | ^5.1.7 | ^5.1.16 | | qs | ^6.15.2 | ^6.16.0 | | vite | ^6.4.2 | ^6.4.4 | | vitest | ^4.1.4 | ^4.1.11 (also @vitest/mocker) | Override floors raised in `pnpm.overrides`: | Override | Before | After | | --- | --- | --- | | simple-git | >=3.36.0 | >=4.0.1 (resolves 4.0.2, @simple-git/argv-parser 2.0.1) | | undici | >=6.24.0 | ^7.29.1 (resolves 7.30.0, stays on 7.x) | | brace-expansion | >=5.0.6 | >=5.0.12 | | postcss | >=8.5.10 | >=8.5.23 (resolves 8.5.30) | Transitive dependencies refreshed within their already-declared ranges (lockfile only): js-yaml 4.3.2, seroval / seroval-plugins 1.6.9, browserslist 4.29.3, baseline-browser-mapping 2.11.28, @babel/core 7.29.7, @humanfs/node 0.16.8, postcss-selector-parser 7.1.6, source-map-js 1.2.2, nanoid 3.3.20, tsx 4.23.15. The tsx bump drops the vulnerable esbuild 0.27.4 in favour of 0.28.2; vite keeps esbuild 0.25.x, which is outside the affected range. This supersedes the open Dependabot PRs #3436 (axios 1.18.0), #3463 (nanoid 5.1.16) and #3410 (vite 6.4.3). Not covered here: the two Go alerts point at `api/go.mod`, which no longer exists on `master`, so they are stale rather than fixable from this repo. Verification, all with the pinned pnpm 10.34.4: - `pnpm install --frozen-lockfile` passes (lockfile is consistent with package.json) - `pnpm lint`, `pnpm exec tsc -b`, `pnpm test` (163 tests) and `vite build` all pass - The build output embeds the current commit sha via unplugin-info, confirming simple-git 4 works with it - `pnpm audit` reports only the `braces` finding noted above **Related issues** N/A (Dependabot security alerts) **Checklist:** - [x] Did you explain what problem does this PR solve? Or what new features have been added? - [ ] Have you added corresponding test cases? (dependency-only change, covered by the existing suite) - [ ] Have you modified the corresponding document? (no documentation impact) - [x] Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
