Skip to content

Update client npm dependencies and clear audit advisories - #2729

Open
ejsmith wants to merge 2 commits into
mainfrom
chore/client-deps-2026-11
Open

ejsmith wants to merge 2 commits into
mainfrom
chore/client-deps-2026-11

Conversation

@ejsmith

@ejsmith ejsmith commented Nov 12, 2026 •

Copy link
Copy Markdown
Member

Refreshes the Svelte client's npm dependencies and clears every fixable npm audit advisory.

Change From → To Why
36 patch/minor bumps (Kit 3.2, Svelte 5.57.3, Vite 8.3.8, Vitest 5.1, Tailwind 4.3.5, bits-ui 2.20.6, layerchart 2.10, Storybook 10.6.7, ESLint 10.14, Playwright 1.65, …) — Routine refresh
tailwind-variants 3.3.1 → 4.0.2 Major; breaking options (twMergeConfig, experimentalParseClassName) aren't used
runed 0.37.1 → 0.38.0 Only runed/kit breaks (needs Kit 3); not used
jsdom 30.1.3 → 31.0.0 Test env only; canvas backend change doesn't affect us
fast-uri override 3.1.8 → 3.1.9 4 advisories (swagger-typescript-api chain)
minimatch override 10.2.6 → 11.0.7 GHSA-g3hv-75wg-m249 (eslint/typescript-eslint); they only use Minimatch#match/minimatch()
katex override 0.16.47 → 0.19.1 GHSA-238p-pmpm-9mq7 (streamdown-svelte); 0.18.11 is deprecated upstream

Audit: 31 (12 moderate) → 11 low. The rest come from deepmerge via @sveltejs/vite-plugin-svelte; no fixed release exists.

Not upgraded: TypeScript 7 — svelte-check and typescript-eslint peers cap at TS 6.

Verified locally: npm run validate (format, svelte-check, lint), npm run test:unit (1149 passed), npm run build. E2E left to CI.

Bump 36 Svelte client packages within their current majors and move the
fast-uri override to 3.1.9 to clear four advisories.
Move tailwind-variants to 4, runed to 0.38 and jsdom to 31, and bump
vite to 8.3.8. Override minimatch to 11.0.7 and katex to 0.19.1 to clear
the remaining moderate and katex advisories.
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 12, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-12T02:58:27.906826Z f0a427e PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

Copy link
Copy Markdown

Code Coverage

Package Line Rate Branch Rate Complexity Health
Exceptionless.AppHost 23% 22% 130 ❌
Exceptionless.Core 78% 70% 11007 ✔
Exceptionless.Insulation 51% 43% 370 ➖
Exceptionless.Web 86% 72% 9415 ✔
Summary 81% (28639 / 35508) 70% (14322 / 20508) 20922 ✔

"svelte-check": "^4.7.8",
"swagger-typescript-api": "^13.14.0",
"tslib": "^2.9.1",
"typescript": "^6.0.3",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we might be able to upgrade to typescript 7 with the recent svelte merges.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants