Skip to content

Security updates#83

Merged
kdybicz merged 7 commits intomasterfrom
dependency-security-update
Feb 20, 2026
Merged

Security updates#83
kdybicz merged 7 commits intomasterfrom
dependency-security-update

Conversation

@kdybicz
Copy link
Owner

@kdybicz kdybicz commented Feb 19, 2026

💡 What's Changed

Upgrade several dev and runtime dependencies and refresh pnpm lock/workspace files. Notable version bumps: @biomejs/biome 2.3.x → 2.4.1, aws-cdk 2.1105.0 → 2.1106.1, dotenv 17.2.x → 17.3.1, webpack 5.105.1 → 5.105.2, webpack-sources 3.3.3 → 3.3.4, and AWS SDK packages (@aws-sdk/client-dynamodb, client-s3, lib-dynamodb) moved to 3.991.0 along with related transitive @aws-sdk updates. pnpm-lock.yaml (and pnpm-workspace.yaml) updated to reflect the new resolutions.
Delete the explicit override pinning mailparser>nodemailer to ^7.0.11. The override was removed from pnpm-lock.yaml and commented out in pnpm-workspace.yaml so the workspace no longer forces that nodemailer version, allowing dependency resolution to choose a compatible release.
@github-actions
Copy link

github-actions bot commented Feb 19, 2026

Coverage report

St.
Category Percentage Covered / Total
🟢 Statements 90.03% 524/582
🟢 Branches 84.04% 179/213
🟢 Functions 88% 88/100
🟢 Lines 89.74% 490/546

Test suite run success

183 tests passing in 14 suites.

Report generated by 🧪jest coverage report action from f5e8862

@kdybicz kdybicz changed the title Security update Security updates Feb 19, 2026
@kdybicz kdybicz marked this pull request as ready for review February 19, 2026 22:32
Add pnpm overrides for ajv (^8.18.0), fast-xml-parser (^5.3.6) and minmatch (^10.2.1) and update pnpm-lock.yaml accordingly. This bumps ajv from 8.17.1→8.18.0 and fast-xml-parser from 5.3.4→5.3.6 across packages and snapshots to enforce consistent dependency resolution. The same overrides are also added to pnpm-workspace.yaml (existing mailparser>nodemailer comment preserved).
Remove unused dependencies from package.json: @types/webpack-sources, webpack-node-externals, email-addresses, and node-fetch. Update pnpm-lock.yaml accordingly to remove their resolutions, packages, and snapshot entries (cleanup of related transitive artifacts).
Update pnpm-lock.yaml and pnpm-workspace.yaml to switch the workspace override from minmatch to glob (^13.0.0) and refresh transitive dependency versions. Notable bumps: @isaacs/cliui -> 9.0.0, glob -> 13.0.3, lru-cache -> 11.2.6, minimatch -> 10.2.0, path-scurry -> 2.0.1, brace-expansion -> 5.0.2, balanced-match -> 4.0.2, jackspeak -> 4.2.3. Several older/deprecated transitive entries (e.g. fs.realpath, inflight, wrap-ansi, emoji-regex older entries) were removed in favor of newer packages and updated engine requirements.
Add minimatch ^10.2.1 override to pnpm-workspace.yaml and update pnpm-lock.yaml to pin minimatch@10.2.1. Remove older duplicate/legacy entries (balanced-match@1.0.2, brace-expansion@1.1.12/2.0.2, concat-map@0.0.1, and previous minimatch versions) and update snapshots/package references so the workspace consistently uses minimatch 10.2.1.
Update @biomejs/biome devDependency from ^2.4.1 to ^2.4.2 and remove jest-junit from devDependencies. Regenerated pnpm-lock.yaml to reflect the biome bump and resulting dependency resolution changes.
@kdybicz kdybicz merged commit 0ac1962 into master Feb 20, 2026
7 checks passed
@kdybicz kdybicz deleted the dependency-security-update branch February 20, 2026 10:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant