Skip to content

fix: resolve dependency security advisories#141

Merged
b3hr4d merged 1 commit intomainfrom
fix/security-advisories-round-2
Apr 14, 2026
Merged

fix: resolve dependency security advisories#141
b3hr4d merged 1 commit intomainfrom
fix/security-advisories-round-2

Conversation

@b3hr4d
Copy link
Copy Markdown
Collaborator

@b3hr4d b3hr4d commented Apr 14, 2026

Summary

  • update root pnpm overrides to safe axios and follow-redirects releases
  • refresh pnpm-lock.yaml and clear root pnpm advisories
  • regenerate the affected example npm lockfiles from clean npm environments so they stop carrying stale vulnerable Vite resolutions
  • align a few example manifest constraints so clean lockfile generation succeeds

Details

  • root overrides:
    • axios -> 1.15.0
    • follow-redirects -> 1.16.0
  • example Vite updates:
    • examples/result-types-demo
    • examples/tanstack-form-demo
    • examples/vite-environment-variables/frontend
  • compatibility cleanups:
    • widen packages/vite-plugin peer range to include Vite 8
    • update examples/result-types-demo to @icp-sdk/core ^5.2.1
    • align examples/vite-environment-variables/frontend/app with compatible vite and eslint versions

Verification

  • pnpm audit --json -> 0 vulnerabilities at the root
  • pnpm install --frozen-lockfile
  • isolated clean npm install --package-lock-only runs for the three affected examples produced lockfiles with found 0 vulnerabilities

@b3hr4d b3hr4d merged commit 5c74ff5 into main Apr 14, 2026
9 checks passed
@b3hr4d b3hr4d deleted the fix/security-advisories-round-2 branch April 14, 2026 10:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant