#1299) ## Summary Resolves 20 of 22 open Dependabot security alerts by updating direct dependencies and adding/updating pnpm overrides. The remaining 2 vite alerts (#234, #237) affecting vite 5.x in spotlight have been dismissed as tolerable risk (dev-only dependency). ## Changes ### Direct dependency updates - **hono** 4.12.14 → 4.12.18 — fixes 5 alerts (#252, #253, #256, #257, #258) - **@hono/node-server** 1.19.10 → 1.19.14 — fixes #238 ### pnpm override updates/additions - **vite** `>=6.0.0 <6.3.6` → `>=6.0.0 <6.4.2` with `~6.4.2` target — fixes #234 for vite 6.x - **vite** added `>=7.0.0 <7.3.2` → `>=7.3.2` override — covers future vite 7.x usage - **lodash** `>=4.17.23` → `>=4.18.0` — fixes #235, #236 - **defu** added `>=6.1.5` — fixes #233 - **fast-uri** added `>=3.1.2` — fixes #254, #255 - **ip-address** added `>=10.1.1` — fixes #251 ### Auto-resolving alerts (via transitive updates) - **@xmldom/xmldom** (#247–250) — already at 0.9.9, above patched 0.8.13 - **astro** (#245, #246, #259, #260) — updated transitively; alerts will auto-close ### Dismissed alerts - **#234** (vite WebSocket file read) — vite 5.4.21 not in vulnerable range `>= 6.0.0` - **#237** (vite path traversal `.map`) — dev-only risk; requires `--host` flag ## Verification - `pnpm run build --filter @spotlightjs/spotlight` — passed - `pnpm run test --filter @spotlightjs/spotlight` — 186/186 tests passed - Website build failure is pre-existing on main (unrelated esbuild/astro compat issue)

Uh oh!

Include a deeper summary in project README #254

Description

Metadata

Metadata

Assignees

Labels

Fields

Projects

Milestone

Relationships

Development

Issue actions