Skip to content

chore: resolve open dependabot security alerts - #65

Merged
jonathannorris merged 3 commits into
mainfrom
chore/dependabot-alerts
Aug 6, 2026
Merged

chore: resolve open dependabot security alerts#65
jonathannorris merged 3 commits into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris

Copy link
Copy Markdown
Member

Summary

  • Resolved 4 open Dependabot security alerts by bumping vulnerable transitive dependencies

Dependabot Alerts Resolved

Alert Package Severity Fix
#71 ip-address high Bumped to 10.4.0 via resolution (was 10.2.0)
#70 ip-address medium Bumped to 10.4.0 via resolution (was 10.2.0)
#69 ip-address medium Bumped to 10.4.0 via resolution (was 10.2.0)
#68 brace-expansion high Bumped to 2.1.4 via resolution (was 2.1.2)

Both packages are transitive dependencies resolved via yarn resolutions in package.json.

- brace-expansion 2.1.1 -> 2.1.2 (high, CVE-2026-13149, alert #67)
- ip-address 10.2.0 -> 10.4.0 (high/medium, alerts #69, #70, #71)
- brace-expansion 2.1.2 -> 2.1.4 (high, alert #68)
Copilot AI review requested due to automatic review settings August 5, 2026 13:37
@jonathannorris
jonathannorris requested a review from a team as a code owner August 5, 2026 13:37
@jonathannorris
jonathannorris enabled auto-merge (squash) August 5, 2026 13:38

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses Dependabot security alerts by forcing patched versions of vulnerable transitive npm dependencies via Yarn resolutions, and updating the lockfile accordingly.

Changes:

  • Add Yarn resolutions overrides for brace-expansion and ip-address to enforce non-vulnerable version ranges.
  • Update yarn.lock to reflect the resolved versions (brace-expansion@2.1.4, ip-address@10.4.0).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Adds Yarn resolutions entries to force patched versions of transitive dependencies.
yarn.lock Updates resolved dependency descriptors/versions/checksums to match the new overrides.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@jonathannorris
jonathannorris merged commit 34ab5e5 into main Aug 6, 2026
4 checks passed
@jonathannorris
jonathannorris deleted the chore/dependabot-alerts branch August 6, 2026 13:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants