Repository navigation
Bump markdown-it, fast-uri, and deepmerge to close Dependabot alerts #90–#96 - #154
Conversation
markdown-it enters via markdownlint-cli2 (pinned 14.3.0). Raise the existing npm overrides floor from ~14.3.1 to ~14.3.3 and refresh the lockfile entry so the resolved package is 14.3.3. Dev-dependency only.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
| Layer / File(s) | Summary |
|---|---|
Update dependency overrides package.json |
The overrides add deepmerge at 4.1.2, update fast-uri from ^3.1.7 to ^3.1.9, and update markdown-it from ~14.3.1 to ~14.3.3. |
Estimated code review effort: 1 (Trivial) | ~2 minutes
Suggested reviewers: cursoragent
Merge Risk: 
f10db
-
The dependency override updates are mergeable with normal checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the three dependency updates and their purpose. It matches the changes described in the pull request. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
Simplify code
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
|
comphy-bot review status for Review completed for this exact pull request head. |
comphy-bot
left a comment
comphy-bot
left a comment
There was a problem hiding this comment.
Review: markdown-it security dependency bump
Reviewed 36f387d6a8133bdd48b9a892f1e97967110dc0db: +4/-4 across the manifest and lockfile.
Findings
No P0/P1 or other actionable findings in the changed lines. The override raises the minimum patch version to ~14.3.3 without permitting a 15.x upgrade, and the lockfile version and registry URL consistently select 14.3.3. The lockfile diff changes only that dependency’s version, tarball URL and integrity; other package metadata is preserved.
Verification
- Exact-head build, markdown-quality and dependency/security PR-hygiene checks passed in the captured check rollup; deployment was skipped and CodeRabbit was pending.
- Central patch checks passed for conflict markers and added trailing whitespace.
- Inspected the manifest, lockfile delta and available peer review evidence. No PR code or package scripts were executed, and registry integrity/advisory closure was not independently reverified.
This approval covers the scoped dependency change, not confirmation that GitHub has already closed the alerts.
Bring the markdown-it override branch current before adding fast-uri and deepmerge alert remediations. Co-authored-by: Vatsal Sanjay | CoMPhy Lab <vatsal.sanjay@comphy-lab.org>
Raise fast-uri override floor to ^3.1.9 (patched 3.x line) and pin deepmerge to 4.1.2 via overrides — GHSA-gcqx-w48m-w2h4 has no patched 4.x release, and 4.1.2 is the latest version outside the vulnerable range. Refresh lockfile entries only; keep markdown-it ~14.3.3.
|
comphy-bot review status for Lane review is complete; findings are being verified and synthesised. |
cursor
Bot
changed the title
npm package-lock refresh dropped libc fields on the @unrs/resolver-binding-linux-* optional packages. Put them back so the security override bump does not churn platform metadata.
|
comphy-bot review status for Review completed for this exact pull request head. |
comphy-bot
left a comment
comphy-bot
left a comment
There was a problem hiding this comment.
Review: dependency security refresh
Reviewed head e4f58826f05480d894f2087caff8ba2343909e2b against base eb72497d881d82efd262947df91b092f08e2a473: +19/-18 across package.json and package-lock.json.
Findings
No actionable findings in the scoped changes. The manifest and lockfile consistently select markdown-it 14.3.3, fast-uri 3.1.9 and the intentional deepmerge 4.1.2 override. The latter is nested under jest-config in the regenerated lockfile. The current diff does not remove Linux libc selectors.
I rechecked the earlier Copilot concern against this head: the expanded PR scope explicitly includes all three dependencies, the deepmerge override is deliberate rather than an accidental range resolution, and the platform-metadata removal is absent. No remaining defect was established from that thread.
Verification
- All required review units are complete; parent synthesis checked the manifest/lockfile interaction and refreshed peer findings and checks.
- Exact-head build, markdown-quality and dependency/security hygiene checks passed. Deployment and CodeRabbit were skipped.
- Central conflict-marker and whitespace checks passed.
- The PR reports 28 test suites / 215 tests passing. I did not independently rerun tests, execute package scripts, verify registry tarball integrity, or confirm Dependabot alert closure. This approval covers the reviewed dependency changes, not confirmation that alerts have closed on the default branch.
Description
GitHub Dependabot alerts on npm devDependencies (lint / test tooling only; not shipped in site runtime):
markdown-it~14.3.3markdown-itfast-uri^3.1.9fast-urifast-urifast-urideepmerge4.1.2markdown-itis transitive viamarkdownlint-cli2@0.23.2(pins14.3.0). Parent upgrade to0.24.0would jump tomarkdown-it15.x (major), so this keeps the existingoverridesapproach.fast-urienters viastylelint→table→ajv. The 3.x advisories are patched in 3.1.9; floor raised from^3.1.7→^3.1.9(no 4.x major).deepmergeenters viajest→jest-config. GHSA-gcqx-w48m-w2h4 covers>=4.2.0, <=4.3.1with no patched 4.x release on npm. Pin to 4.1.2 (latest outside the vulnerable range / Snyk “latest non vulnerable”).Type of Change
Changes Made
overrides.markdown-itat~14.3.3(lockfile already on 14.3.3)overrides.fast-urifrom^3.1.7→^3.1.9; lockfile → 3.1.9overrides.deepmerge:4.1.2; lockfile → 4.1.2 underjest-configmaininto the branch so CI runs against current site contentTesting Done
npm ls markdown-it fast-uri deepmerge→ overridden at 14.3.3 / 3.1.9 / 4.1.2npm audit→ no findings formarkdown-it,fast-uri, ordeepmergenpm test(28 suites / 215 tests passed)./scripts/build.sh --skip-deps(Jekyll build succeeded)Related Issues
Closes Dependabot alerts #90–#96.
Checklist
Additional Notes
Dev-dependency only — site runtime / production pages do not ship these packages. Alerts should auto-close once Dependabot sees the remediated versions on
main.Summary by CodeRabbit