fix(deps): stabilize installs and update vulnerable utilities - #92
Open
Bircck wants to merge 1 commit into
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+55
to
+66
| name: ci | ||
| if: always() | ||
| needs: [generator, website] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Require all checks to pass | ||
| env: | ||
| GENERATOR_RESULT: ${{ needs.generator.result }} | ||
| WEBSITE_RESULT: ${{ needs.website.result }} | ||
| run: | | ||
| test "$GENERATOR_RESULT" = success | ||
| test "$WEBSITE_RESULT" = success |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine lockfile refreshes removed an undeclared Emotion dependency and broke the website build. Declare the existing Emotion versions explicitly and update vulnerable utility dependencies, including Nano ID, humanfs, PostCSS, tar, lint utilities, and root lodash, while preserving framework/authentication versions.
Use npm ci in the shared Azure build template, test the currently configured Node versions in CI, and provide the aggregate ci status required by branch rules. Document how nightly consumers can pin one reviewed commit in both stages, validate a canary, and retain a rollback artifact.
Validation: generator tests passed (101 passed, 2 existing skips); workflow YAML parsed; root npm audit clean; website audit reduced from 19 to 8 affected packages. Clean npm ci, lint, production build, and packaged standalone HTTP authentication/session/static-asset checks passed on Node 22.23.2. Visual verification and the Linux CI matrix have not run. Existing copied consumer templates require adoption by their owners.