Skip to content

chore(deps): bump vite in paperclip lockfile - #5876

Merged
cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261020-npm-paperclip
Oct 20, 2026
Merged

cdbartholomew merged 1 commit into
mainfrom
chore/security-daily-20261020-npm-paperclip

Conversation

@cdbartholomew

Copy link
Copy Markdown
Contributor

Routine dependency maintenance for hindsight-integrations/paperclip/package-lock.json.

Closes Dependabot alert #1969

  • vite 8.3.0 → 8.3.4 (dev dependency via vitest; GHSA-698v-4r3x-3vcv, fixed in 8.3.3)
  • rolldown 1.2.8 → 1.2.14 and its @rolldown/binding-* platform packages, @oxc-project/types 0.149.0 → 0.154.0 (required by the newer vite)

No packages were added or removed; only the 18 entries above changed version.

The lockfile was regenerated with npm@11 update vite --package-lock-only. npm 10.9.2 aborts on the same command with Cannot read properties of null (reading 'edgesOut'); the npm 11 result was then checked with npm 10.9.2 npm ci, which is what CI runs, and it installs cleanly.

Verification

  • npm ci (npm 10.9.2, as CI runs it): OK
  • npm run build: OK
  • npm test: 2 files, 71 tests passed
  • npx tsc --noEmit: OK

@cdbartholomew cdbartholomew added security Security / dependency vulnerability remediation p2 Medium severity - remediate within 60 days labels Oct 20, 2026
@cdbartholomew cdbartholomew self-assigned this Oct 20, 2026
@cdbartholomew cdbartholomew added the p2 Medium severity - remediate within 60 days label Oct 20, 2026
@cdbartholomew
cdbartholomew merged commit 08ff518 into main Oct 20, 2026
100 checks passed
@cdbartholomew
cdbartholomew deleted the chore/security-daily-20261020-npm-paperclip branch October 20, 2026 21:12
@nicoloboschi nicoloboschi mentioned this pull request Nov 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

p2 Medium severity - remediate within 60 days security Security / dependency vulnerability remediation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant