Skip to content

chore(docs): override the transitive deps Dependabot cannot reach - #231

Merged
ManukMinasyan merged 2 commits into
3.xfrom
chore/docs-security-overrides
Sep 16, 2026
Merged

ManukMinasyan merged 2 commits into
3.xfrom
chore/docs-security-overrides

Conversation

@ManukMinasyan

Copy link
Copy Markdown
Collaborator

The weekly Dependabot security run for /docs has failed on every attempt since 2026-09-09 with conflicting-dependencies. esbuild, sharp and @tiptap/core are not direct dependencies: they sit behind docus and nuxt, which cap them below the patched versions. Dependabot reports "the latest possible version that can be installed is 0.25.12" and gives up, so no PR is ever opened and the advisories stay open.

docus is already at its latest (5.13.0), so an overrides block in docs/package.json is the only lever:

package was now advisory
esbuild 0.25.12, 0.27.3, 0.27.7 0.28.2 >= 0.17.0 < 0.28.1
sharp 0.35.3 0.35.4 < 0.35.4
@tiptap/core 3.30.2 3.31.3 >= 3.7.0 < 3.30.5
js-yaml 4.3.1 4.3.2 >= 4.0.0 < 4.3.2

comark keeps its nested js-yaml 5.4.1, which is above the 5.x advisory range.

Verified locally: npm install reports 0 vulnerabilities, and npm run generate with the deploy workflow environment prerenders all 71 routes.

Supersedes #229 (the js-yaml bump is included here).

esbuild, sharp and @tiptap/core sit behind docus and nuxt, so the weekly
security run failed on conflicting-dependencies instead of opening a PR.
Copilot AI lite review requested due to automatic review settings September 16, 2026 10:34

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@ManukMinasyan
ManukMinasyan added this pull request to the merge queue Sep 16, 2026
Merged via the queue into 3.x with commit c8ba75b Sep 16, 2026
9 checks passed
@ManukMinasyan
ManukMinasyan deleted the chore/docs-security-overrides branch September 16, 2026 14:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants