Skip to content

Pin dependency overrides in package.json and update lockfile#6

Open
WPISabaGanji wants to merge 3 commits into
devfrom
codex/fix-github-security-alerts-in-dependencies-dutmmr
Open

Pin dependency overrides in package.json and update lockfile#6
WPISabaGanji wants to merge 3 commits into
devfrom
codex/fix-github-security-alerts-in-dependencies-dutmmr

Conversation

@WPISabaGanji

Copy link
Copy Markdown
Contributor

Motivation

  • Ensure consistent, secure versions of transitive dependencies by pinning specific packages via an overrides section.
  • Address multiple transitive package updates and potential vulnerabilities by forcing known-good versions for webpack-dev-server and related sub-dependencies.
  • Regenerate the lockfile to reflect the pinned versions and produce reproducible installs.

Description

  • Added an overrides section to package.json that pins webpack-dev-server to 5.2.1 and fixes versions for related packages such as open, p-retry, rimraf, webpack-dev-middleware, ws and several others.
  • Applied additional overrides for a set of transitive dependencies including brace-expansion, on-headers, shell-quote, node-forge, minimatch, picomatch, lodash, serialize-javascript, svgo, fast-uri, js-yaml (for several Docusaurus packages), and npm sub-dependencies like glob/minimatch/tar.
  • Updated package-lock.json to reflect the pinned versions and multiple upgraded/transitive package versions (for example: webpack-dev-server -> 5.2.1, js-yaml -> 4.1.1, lodash -> 4.17.23, serialize-javascript -> 7.0.4, svgo -> 3.3.3, and others).
  • Adjusted various package engine and dependency entries as required by the updated versions in the lockfile.

Testing

  • Ran npm install to apply the overrides and regenerate package-lock.json, and the install completed successfully.
  • Ran npm ci against the updated lockfile to verify a clean install from the lockfile, and it completed successfully.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant