fix(deps): raise JS test-harness CVE floors for the 2026-08-19 Dependabot alerts - #65
Conversation
…abot alerts Five new HIGH alerts landed against kotlin-js-store/yarn.lock, all in the karma/webpack/mocha test harness for the JS target — dev-time only, nothing here ships in published artifacts. Renovate cannot fix these (the lockfile is generated by the Kotlin Gradle plugin; no package.json exists for its npm manager) and Dependabot is deliberately disabled for this directory, so the floors are raised as yarn resolutions, same as the previous two rounds (#5, #21): - brace-expansion 2.1.2 -> 2.1.4 (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895) - fast-uri 3.1.4 -> 3.1.5 (GHSA-7p8r-x3mc-p8w7) - js-yaml 4.3.0 -> 4.3.1 (GHSA-5p4m-2wfm-xmqj) - socket.io-parser new floor 4.2.7 (GHSA-2m8v-j782-fhvr) Lockfile regenerated with the kotlinUpgradeYarnLock Gradle task; jsTest passes. Signed-off-by: James Rich <2199651+jamesarich@users.noreply.github.com>
|
Warning Review limit reached
Next review available in: 38 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Raises the yarn resolution floors in
build.gradle.ktspast the five HIGH Dependabot alerts that landed 2026-08-19 againstkotlin-js-store/yarn.lock, and regenerates the lock. All five are in the karma/webpack/mocha harness for the JS test target — dev-time only, nothing ships in published artifacts.Renovate cannot raise these (the lockfile is generated by the Kotlin Gradle plugin; there is no
package.jsonfor its npm manager) and Dependabot is deliberately disabled for this directory — same situation and same fix as #5 and #21.Type of change
Affirmations
git commit -s).CONTRIBUTING.md.If this changes the public API…(no API change)If this changes codec behavior or the wire frame…(no codec change)How was this verified?
Regenerated the lock with the
kotlinUpgradeYarnLockGradle task, confirmed all four packages resolve at their patched versions inyarn.lock, and ranjsTest— passes with the new pins.Notes for reviewers
Third round of this pattern. Each resolution can be dropped once the transitive tree requires at least that version on its own.
🤖 Generated with Claude Code