Skip to content

fix: update next and patch vulnerable transitive deps - #389

Draft
josephfusco wants to merge 2 commits into
mainfrom
fix/vuln-lockfile-bumps
Draft

josephfusco wants to merge 2 commits into
mainfrom
fix/vuln-lockfile-bumps

Conversation

@josephfusco

@josephfusco josephfusco commented Oct 21, 2026 •

Copy link
Copy Markdown
Member

This clears every open Dependabot alert here except braces, which has no patched release; the postcss-selector-parser override moves @tailwindcss/typography from 6.0.10 to 7.1.7, and I checked that the compiled global.css is byte-for-byte identical before and after.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Assisting with raising the pnpm overrides, tracing the vulnerable packages and checking the CSS output.

@josephfusco josephfusco added the dependencies Pull requests that update a dependency file label Oct 21, 2026
@headless-platform-by-wp-engine

Copy link
Copy Markdown

Check out the recent updates to your Headless Platform preview environment:

App Environment URL Build
faustjs.org preview-env-fix/vuln-lockfile-bumps https://hs…wered.com ✅ (logs)

Learn more about preview environments in our documentation.

theodesp
theodesp previously approved these changes Oct 22, 2026
@josephfusco josephfusco changed the title fix: raise brace-expansion and shell-quote overrides to patched versions fix: update next and patch vulnerable transitive deps Oct 22, 2026
@headless-platform-by-wp-engine

Copy link
Copy Markdown

Check out the recent updates to your Headless Platform preview environment:

App Environment URL Build
faustjs.org preview-env-fix/vuln-lockfile-bumps https://hs…wered.com ✅ (logs)

Learn more about preview environments in our documentation.

@headless-platform-by-wp-engine

Copy link
Copy Markdown

Check out the recent updates to your Headless Platform preview environment:

App Environment URL Build
faustjs.org preview-env-fix/vuln-lockfile-bumps https://hs…wered.com ✅ (logs)

Learn more about preview environments in our documentation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants