Skip to content

Update packages#23

Merged
gauthierm merged 10 commits intosilverorange:masterfrom
cviebrock:update-packages
Mar 17, 2026
Merged

Update packages#23
gauthierm merged 10 commits intosilverorange:masterfrom
cviebrock:update-packages

Conversation

@cviebrock
Copy link
Copy Markdown

This fixes a few Dependabot vulnerabilities in the package:

  1. Most dependencies have been bumped to the latest versions.
  2. The brace-expansion package (required by minimatch) is still vulnerable, so we override it to the next patch version which fixes the issue.
  3. The postcss-url package hasn't been maintained in several years. We only use it in one place in the code to rebase URLs. This is replaced with the better-maintained postcss-rebase-url package.
  4. chokidar has been updated and has a different way to define the watch and ignore paths. This has been updated.
  5. globby needed to be imported differently.
  6. NEW: pnpm prettier:write script added
  7. Moved from "CommonJS" and "node10" in module resolution to "NodeNext". This was required in order to get the postcss-rebase-url package recognized. (TBH, I'm not sure if there are any knock-on effects.)

All the CI checks still pass, and pnpm audit returns no vulnerabilities. 🎉

It has been tested by symlinking the package and build binary over to a working project, and running yarn legaseer. The output looks identical to what it was with the previous version. The --symlink=foo,bar feature works. And updating a .less file in the project triggers a recompile, as expected.

@cviebrock cviebrock requested a review from gauthierm March 16, 2026 18:15
@gauthierm gauthierm merged commit 351ade5 into silverorange:master Mar 17, 2026
1 check passed
@cviebrock cviebrock deleted the update-packages branch March 19, 2026 17:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants