Repository navigation
build(deps-dev): upgrade every dependency to its latest safe version - #219
Merged
Merged
Conversation
Pins the three obsidian-plugin-workflows reusable workflows to the v4 commit (ebcf84b) instead of the moving tag, which closes the actions/unpinned-tag code-scanning alerts. Folds in the Dependabot actions group (harden-runner v2.22.1, setup-node v7.1.0) and moves codeql-action to v4.39.0 with an exact version comment.
pnpm 10.32.1 is affected by several high-severity pnpm advisories (fixed in 10.34.5). pnpm 11+ only reads settings from pnpm-workspace.yaml, so the build allowlist (now allowBuilds) and the overrides move there and .npmrc goes away (autoInstallPeers is the default). The workspace now refuses releases younger than 7 days and any recent release whose provenance is weaker than earlier versions. The lockfile is re-resolved under that policy. Node >=22.13 matches the floor of pnpm 12, ESLint 10 and Vitest 5.
… TypeScript Svelte 5 strips type annotations in <script lang="ts"> itself. Our components only use type-level TypeScript and plain <style>, so the preprocessor (and its postinstall script) did nothing: main.js is byte-identical without it.
We only used esbuild-svelte to call svelte/compiler's compile() with css: "injected". Its caching, preprocess, external-CSS and .svelte.ts paths were dead code for us. The inline plugin keeps esbuild-formatted warnings and errors and watch-mode rebuilds, and main.js is byte-identical.
eslint-plugin-svelte's flat config already brings and wires svelte-eslint-parser, and nothing imports tslib (esbuild inlines its own helpers).
… core ESLint ESLint 10.13, typescript-eslint 8.71, eslint-plugin-svelte 3.23, globals 17.13. The config moves from the deprecated tseslint.config() helper to defineConfig() from eslint/config. eslint-plugin-obsidianmd was 185 of our 526 locked packages (including its own TypeScript 5.4 and Obsidian 1.12 copies, plus four ESLint plugins that cap ESLint at 9) for the seven rules we enable. Each of those rules is a global-reference or AST-shape check, so they are now no-restricted-globals / no-restricted-syntax entries that name the upstream rule. A probe file confirmed every rule fires on its positive case and stays quiet on the upstream negatives (window timers, local 'document', --css-variables).
Vitest 5.0.5 with Vite 8.3.4. The suite needed no changes: no test relies on mocks surviving between tests (now cleared by default) or on un-awaited async assertions (now failures). @vitest/coverage-v8 only backed a local test:coverage script that no CI job, check or doc workflow consumed, so it goes along with the script and its ignore entries. This also clears GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp in @vitest/mocker 4.1.11.
0.14 drops the vite-plus peer, which removes the last pnpm audit findings (GHSA-587h-7wmj-h5pm high and four lower vite-plus advisories), and types its matchers against Vitest 5. No harness API we use changed. The live suite runs 104 passed / 1 skipped against Obsidian 1.13.7; the 3 multi-value.test.ts failures reproduce with master's main.js and are tracked separately.
obsidian 1.13.1 -> 1.14.4, svelte 5.57.1 -> 5.57.2, svelte-check 4.7.6 -> 4.7.7, @types/node 26.6.2 -> 26.6.5. Typecheck is clean. PluginSettingTab.display() is deprecated since Obsidian 1.13 in favor of getSettingDefinitions(), but moving to it would raise minAppVersion past 1.12.7, so that stays a separate product decision.
Every component is a runes component, so the Svelte 4 ComponentType branch (deprecated in Svelte 5) is dead. Props are now taken from the component with NoInfer, so svelte-check still rejects unknown or mistyped props at each mount call.
All twelve overrides were floors for advisories in transitive packages. After the upgrades and removals, the packages they targeted are either gone (@babel/core, fast-uri, handlebars, js-yaml, tinypool) or already resolve at or above the patched version (brace-expansion 5.0.12, moment 2.31.0, nanoid 3.3.20, postcss 8.5.30, postcss-selector-parser 7.1.6, source-map-js 1.2.2). pnpm audit is clean without them.
The iOS and Android harnesses ran with an unpinned 'uv run --with pymobiledevice3/websockets', so every run resolved the newest release of the whole dependency tree. They now carry PEP 723 script metadata pinning pymobiledevice3 11.33.1 and websockets 17.2 with exclude-newer 2026-10-17 for transitive packages, and the documented commands become 'uv run scripts/mobile/<script>.py'.
pnpm 12 ignores the "pnpm" field in package.json, so the docs site's build allowlist was dead and every install failed with ERR_PNPM_IGNORED_BUILDS. website/ now has its own pnpm-workspace.yaml with the plugin's release-age and trust policy. The file also makes website/ its own workspace root. None of the three install scripts is needed. esbuild, workerd and sharp all ship prebuilt binaries as optional dependencies, so allowBuilds denies them explicitly instead of allowing them. packageManager pins pnpm 12.14.0. Cloudflare Workers Builds otherwise installs with its default pnpm 10.11.1, which predates these settings.
Astro 7.0.3 is affected by GHSA-26w7-cxv4-gfx2 (critical, RCE through AVIF optimization, fixed in 7.2.8), GHSA-98hj-9722-w3j8 (XSS, fixed in 7.3.2) and GHSA-mpr7-6m5w-76rw (fixed in 7.3.3). 7.4.0 is the newest release past the 7-day age gate. It also moves Vite to 8.3.4, past the Vite dev-server advisories fixed in 8.3.3, and Sharp to 0.35.5. Starlight 0.42 requires Astro 7.2.10 and starlight-links-validator 0.26+ requires Starlight 0.42, so the three move together. Starlight 0.42's breaking changes are the mobile menu markup and the removed "tagline" config option. The site styles neither, and the hero "tagline" in index.mdx is unrelated frontmatter.
Sharp 0.34.5 is affected by GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c and GHSA-wq5f-xc86-pv6w (libvips, libheif and librsvg), fixed in 0.35.5. Astro's image service does not need this dependency. Astro declares Sharp as its own optional dependency and resolves that copy, so images optimized with 0.35.5 even while the direct dependency was 0.34.5. scripts/generate-og-image.mjs imports Sharp directly, and pnpm's strict layout hides Astro's copy from it, so the direct dependency stays. At ^0.35.5 it dedupes with Astro's copy. The script still renders og.png under 0.35, whose breaking changes do not touch sharp(svg).png().
… 5.3.0 The font files and CSS are byte-identical to 5.2.x. 5.3.0 only adds a CSS module type declaration and package metadata.
4.151.1 is the newest release past the 7-day age gate. It brings Sharp 0.35.5 through Miniflare, so Sharp 0.34.5 and its install script leave the tree and allowBuilds no longer lists Sharp. Wrangler stays a dev dependency. Workers Builds runs "npx wrangler deploy" with the Wrangler version from package.json, so dropping it would deploy with whatever npm serves at build time, outside the lockfile and the release-age policy. wrangler.jsonc needs no changes, and "wrangler dev" still serves dist/ with the 404 page.
…e-age policy A fresh resolution moves every transitive dependency to its newest release that is at least 7 days old. That clears the stale duplicates pnpm audit flagged: postcss 8.5.16, js-yaml 4.3.0, nanoid 3.3.15, source-map-js 1.2.1 and zod 4.4.3 now resolve to 8.5.30, 4.3.2, 3.3.20, 1.2.2 and 4.6.7. All 424 locked packages were published at least 7 days ago.
…dencies After the re-resolution pnpm audit still reports two packages that their parents pin below the fix: - undici 7.29.1, pinned exactly by Miniflare: GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685 and GHSA-f72v-6w45-q472, fixed in 7.30.1. - postcss-selector-parser 6.1.4, via postcss-nested 6 in Expressive Code: GHSA-rj75-hqrm-r3gf, fixed in 7.1.6. The plugin's workspace already carries the same override. The built site is byte-identical with and without the overrides, and "wrangler dev" still serves it. pnpm audit is now clean.
website/ has its own lockfile, which the root npm entry never looked at. The new entry mirrors the root's schedule and 7-day cooldown with two differences. A single group holds every minor and patch update, because Astro, Starlight and starlight-links-validator require each other's new versions. The commit prefix is build(website) instead of build with include: scope, because include: scope would title production bumps build(deps), and the release policy releases the plugin for those.
The CardGrid "stagger" prop never took effect on the live site. Astro 7.0 scoped the stagger selector to the card children, which do not carry the grid's scope class. Astro 7.4 fixes the scoping, so the right column dropped 5rem, and the custom "lift on hover" transform replaced the stagger transform, making those cards jump 82px up on hover. Dropping the prop keeps the aligned grid the site has always shown and the hover lift works on every card.
The native widget roundtrip test compared document.body's child count before and after, so a transient Obsidian element from an earlier test (a fading notice, a closing modal) disappearing mid-test read as -1 and failed it. It failed 2 of 9 full-suite runs and 0 of 3 runs of its own file. The check now counts elements added during the measurement that are still attached, which is what a leak is. A probe confirmed it reports 1 for a leaked element and 0 when only a pre-existing element goes away.
…ll script esbuild-svelte compiled .svelte.js/.svelte.ts rune modules. The inline plugin doesn't, and without a guard such a file would bundle as plain TypeScript and throw at runtime, so it is now a build error. esbuild's binary arrives as an optional dependency, so its install script is denied, as in the docs site.
…rules Also documents that the core-rule replacement flags typeof guards, which the obsidianmd rules skipped.
obsidian-plugin-workflows bumps change release behavior, so they leave the actions group. engines.node excludes Node 23, which ESLint 10 and Vitest 5 do not support.
In production the DEVCMD stripper loaded first and returned source for a .svelte.ts file with dev-command markers, so the rune-module guard never ran. The guard is now its own plugin registered first. It rejects rune modules with and without markers, in dev and production.
Dependabot names each reusable-workflow path as its own dependency, so excluding the toolkit from the actions group alone would split one toolkit bump into three PRs that can land out of sync.
…ugin name Vitest 5 rejects Node 25 as it does Node 23. The manifest name is read once next to the imports and escaped before it goes into the selector.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
metaedit-docs | 27654b1 | Oct 24 2026, 08:47 AM |
chhoumann
marked this pull request as ready for review
October 24, 2026 08:48
This was referenced Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security sweep of every dependency in the repo: npm packages, the lockfiles, GitHub Actions, the shared release workflows, the docs site and the mobile harness. It moves each to its latest safe release and removes what we barely used. Nothing in the shipped plugin changes behavior:
main.jsdiffers from master only by Svelte's 5.57.1 to 5.57.2 runtime patch and one refactored helper.Supersedes #215 (Dependabot actions group). That PR is left open for you to close.
What changes for you
pnpm auditis clean in both workspaces. It reported 7 advisories (1 high) at the root and 12 (8 high, including a critical Astro RCE) in the docs site.pnpm-workspace.yamlfiles refuse releases younger than 7 days, and refuse a release from the last year whose provenance is weaker than earlier versions'. Dependabot gets the same 7-day cooldown.actions/unpinned-tagalerts.Dependencies
"Safe" here means a stable release, no known advisory (
pnpm audit, GitHub advisory DB), at least 7 days old, and no new install script. The newest release was skipped wherever it was younger than that. The table lists those cases.Plugin (
package.json,pnpm-lock.yaml)packageManager)package.json#pnpmand.npmrctopnpm-workspace.yaml, andonlyBuiltDependenciesbecameallowBuilds. 12.15.0 is 3 days old.engines)tseslint.config()todefineConfigfromeslint/config.configs.recommended(flat).@vitest/mocker). The suite needed no changes.test:coveragescript that nothing consumed. The script went too.vite-pluspeer (GHSA-587h-7wmj-h5pm high, plus 4 more). It is our own package, published with provenance, and exempt from the age gate.display().esbuild.config.mjs. See Removals.<script lang="ts">itself.main.jsis byte-identical without it.pnpm.overridesDocs site (
website/)packageManager)pnpm-workspace.yamlwith the same policy. Pinning matters because Workers Builds otherwise installs with pnpm 10.11.1.scripts/generate-og-image.mjs. It now shares Astro's copy.npxlatest.undici,postcss-selector-parserGitHub Actions and reusable workflows
@v4tagebcf84b# v4 (the current head of v4)2892aa5# v4Dependabot now covers
website/. Its bumps are titledbuild(website):so they can't trigger a plugin release. Toolkit bumps get their own group, so the three release stubs move together in one PR instead of riding the actions group.Other pinned tooling
uv run --withexclude-newer2026-10-17uv run --withRemovals and vendoring
no-restricted-globals/no-restricted-syntaxentries whose messages name the upstream rule. A probe file showed every rule fires on its positive cases and stays quiet on the upstream negatives. One deliberate difference: the core rules also flagtypeof documentguards, which the plugin source has none of.compile()withcss: "injected". Its caching, preprocess, external-CSS and rune-module paths were dead for us. The inline plugin keeps esbuild-formatted warnings and errors and watch rebuilds.main.jsis byte-identical. Rune modules (.svelte.ts) now fail the build loudly instead of being silently mis-bundled.Also in this PR
src/svelteMount.tsdrops the Svelte 4ComponentTypebranch, which Svelte 5 deprecates. All six components use runes. svelte-check still rejects unknown or mistyped props at each mount call, verified by a probe.<CardGrid stagger>, which was broken on the live site, and that shifted the landing-page grid.staggeris removed so the grid matches the live site.Risks
.release-toolkitinside this repo. Itspnpm installnow finds ourpnpm-workspace.yaml, switches to pnpm 12.14.0, and applies our age and trust policy to the toolkit's lockfile. It passes today, as a reviewer reproduced. A toolkit lockfile carrying a package younger than 7 days would fail the release job. The robust fix is--ignore-workspacein the toolkit's install step, in obsidian-plugin-workflows. Until then, aworkflow_dispatchof Prepare release withdry-run: trueafter merging is cheap insurance.PluginSettingTab.display()is deprecated since Obsidian 1.13 in favor ofgetSettingDefinitions(). Migrating would raiseminAppVersionpast 1.12.7 and drop users on 1.12, so it is not done here.tsc -p tsconfig.jsonwith 71 errors. That count is identical on master. No script or CI job typechecks tests, so it is left for its own change.5.20261012.1-beta). It is used only bywrangler dev.Verification
pnpm run lint,pnpm run build(includestscandsvelte-check) andpnpm run testall pass: 19 files, 359 tests.pnpm install --frozen-lockfile && pnpm run buildproduces 35 pages and passes the links validator. Pages were checked in a browser against a build of master: fonts, logo, dark mode, mobile menu and search.obsidian-e2evault.api.update("status", "closed")andapi.createYamlProperty("reviewed", "yes")on a note produced---\nstatus: closed\ntags:\n - a\nreviewed: yes\n---.getPropertyValuereadclosedback.multi-value.test.tsfail on master too.Note
Medium Risk
Large tooling and lockfile changes affect CI, releases, and installs (pnpm age/trust policy may interact with the release toolkit), though shipped plugin behavior is intended to stay the same aside from a minor Svelte patch and build-path refactors.
Overview
This PR is a repo-wide dependency and supply-chain refresh: npm/pnpm lockfiles, GitHub Actions, the shared release workflow stubs, the
website/docs workspace, and mobile Python harness pins.Tooling and policy. The plugin moves to pnpm 12.14.0 with
pnpm-workspace.yamlrules (7-dayminimumReleaseAge,trustPolicy,allowBuildsfor esbuild). Nodeenginesnarrow to supported LTS ranges. Dependabot adds 7-day cooldowns, a separatewebsite/npm ecosystem withbuild(website):commits, and an isolated release-toolkit group forobsidian-plugin-workflows. The docs site gets its ownwebsite/pnpm-workspace.yamland upgraded Astro/Starlight stack; the landing page drops broken<CardGrid stagger>.Build and lint.
esbuild.config.mjsdropsesbuild-svelte/svelte-preprocessin favor of a customcompileSvelteplugin (Sveltecompile+ injected CSS) and explicit rejection of.svelte.tsrune modules. ESLint 10 dropseslint-plugin-obsidianmdand re-expresses the same Obsidian guideline checks viano-restricted-globals/no-restricted-syntax.test:coverageand@vitest/coverage-v8are removed; Vitest 5 and related dev deps are bumped.CI and release. Workflow actions are re-pinned (e.g. harden-runner, setup-node, CodeQL); reusable release workflows move from
@v4tags to a full commit SHA.Small code/test tweaks.
src/svelteMount.tsis Svelte 5–only (no legacyComponentTypepath). E2E cleanup measurement countsleakedBodyChildrenby identity instead of body child count delta. Mobile scripts declare PEP 723 deps foruv runwithout--with.Reviewed by Cursor Bugbot for commit 97bde8d. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Upgrade all dev dependencies and replace esbuild-svelte with direct svelte/compiler integration
esbuild-svelte,svelte-preprocess,eslint-plugin-obsidianmd, and coverage tooling; the removed Obsidian lint rules are reimplemented as coreno-restricted-globalsandno-restricted-syntaxselectors in eslint.config.mjscompileSvelteesbuild plugin that compiles Svelte files directly withsvelte/compiler, plus a plugin that rejects.svelte.jsand.svelte.tsrune modulesmountSvelteComponentin src/svelteMount.ts no longer accepts older Svelte component forms, and builds now fail on Svelte rune modules;test:coveragescript and coverage ignore entries are removedMacroscope summarized 97bde8d.