Repository navigation
build(deps): update release tooling dependencies - #9
Merged
Merged
Conversation
Refresh the transitive npm dependencies of the semantic-release toolchain to patched versions, which closes the open Dependabot alerts for braces, handlebars, js-yaml, lodash, lodash-es, picomatch and undici. undici is pinned to the 7.x line via pnpm.overrides because the patched 8.x releases require a newer Node than the release job uses.
This was referenced Oct 30, 2026
github-actions Bot
pushed a commit
that referenced
this pull request
Oct 30, 2026
## 1.7.0 (2026-10-30) * feat(velocity): add network, session and backend metrics (#11) ([283d947](283d947)), closes [#11](#11) * fix(velocity): report the plugin version (#10) ([90b136d](90b136d)), closes [#10](#10) * build(deps): update release tooling dependencies (#9) ([42b709e](42b709e)), closes [#9](#9) * docs(openspec): propose velocity metrics and version fix (#8) ([a4f7069](a4f7069)), closes [#8](#8)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The npm tooling that publishes our releases (semantic-release and its plugins) pulled in several transitive packages with open security advisories. None of them ships inside the plugin jar, but they run in the release job, which holds the repository write token, so they are worth closing now. This change moves those packages to patched versions without changing the major version of any semantic-release plugin.
The one exception is undici. Its patched 8.x line needs a newer Node than the release job runs, so undici stays on its 7.x line at the first patched release or later. The
@semantic-release/githubplugin also stays on its current range for the same reason. The Dependabot PRs for handlebars (#3) and undici (#4) are superseded by this change.Change Type
Tests
Details:
pnpm install --frozen-lockfilepasses with pnpm 9, the version the release workflow uses.pnpm audit --prod=false: 56 advisories before the change (3 critical, 20 high, 27 moderate, 6 low), none after.semantic-release --versionruns under Node 20.20, the release job's Node version, and the release plugins load there. No dry run and no release token were used; nothing was published.Checklist