Dependabot reports vulnerable brace-expansion 2.x/5.x and source-map-js in pnpm-lock.yaml. Pin compatible patched versions (2.1.7, 5.0.12, and 1.2.2) and refresh the lockfile to resolve alerts #67–72 and #75.
Validation: frozen pnpm install, existing dependency-security regression test, Nitro production build, and the CI audit command pass. The full production audit now reports only two high advisories with no published fix: braces (GHSA-vfj7-8cjw-p6xm, #74) and node-forge (GHSA-86w9-cpqp-85rv, #73), introduced by Nitro through globby/micromatch and listhen respectively. Those alerts remain open.
Dependabot reports vulnerable brace-expansion 2.x/5.x and source-map-js in pnpm-lock.yaml. Pin compatible patched versions (2.1.7, 5.0.12, and 1.2.2) and refresh the lockfile to resolve alerts #67–72 and #75.
Validation: frozen pnpm install, existing dependency-security regression test, Nitro production build, and the CI audit command pass. The full production audit now reports only two high advisories with no published fix: braces (GHSA-vfj7-8cjw-p6xm, #74) and node-forge (GHSA-86w9-cpqp-85rv, #73), introduced by Nitro through globby/micromatch and listhen respectively. Those alerts remain open.
---
GitHub 来源:https://github.com/xixu-me/xdpl/pull/12
作者:xixu-me · 创建时间:2026-10-08T06:33:12Z
GitHub PR 状态:已合并,合并提交 088bfcf1e4642f9b3aedf56766508b49828fe691
<!-- github-archive:4782820123 -->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Dependabot reports vulnerable brace-expansion 2.x/5.x and source-map-js in pnpm-lock.yaml. Pin compatible patched versions (2.1.7, 5.0.12, and 1.2.2) and refresh the lockfile to resolve alerts #67–72 and #75.
Validation: frozen pnpm install, existing dependency-security regression test, Nitro production build, and the CI audit command pass. The full production audit now reports only two high advisories with no published fix: braces (GHSA-vfj7-8cjw-p6xm, #74) and node-forge (GHSA-86w9-cpqp-85rv, #73), introduced by Nitro through globby/micromatch and listhen respectively. Those alerts remain open.
GitHub 来源:https://github.com/xixu-me/xdpl/pull/12
作者:xixu-me · 创建时间:2026-10-08T06:33:12Z
GitHub PR 状态:已合并,合并提交
088bfcf1e4The latest updates on your projects. Learn more about Vercel for GitHub.
GitHub 来源:https://github.com/xixu-me/xdpl/pull/12#issuecomment-6053939190
作者:vercel[bot] · 创建时间:2026-10-08T06:33:13Z
Pull request closed