chore: regenerate lockfile and remove 65 unnecessary resolutions#7028
Open
bobbor wants to merge 12 commits into
Open
chore: regenerate lockfile and remove 65 unnecessary resolutions#7028bobbor wants to merge 12 commits into
bobbor wants to merge 12 commits into
Conversation
|
…nerator path @aws-amplify/graphql-docs-generator@4.2.1 pins handlebars@4.7.7 (exact). Fix version is 4.7.9. Resolution forces safe version. Fixes: GHSA-2w6w-674q-4c4q (critical), GHSA-3mfm-83xf-c92r (high), GHSA-9cx6-37pm-9jff (high), GHSA-xhpv-hc6g-r9c6 (high), GHSA-xjpj-3mr7-gcpf (high)
Adds resolutions to fix newly-introduced vulnerable transitive deps: - **/@aws-amplify/**/fast-xml-parser: ^5.5.6 (5.2.5 from data-construct) - **/@graphql-codegen/**/lodash: ^4.18.1 (4.17.23 from plugin-helpers) - **/relay-compiler/**/immutable: ^4.0.0 (3.7.6 from relay-compiler) - **/next/postcss: ^8.5.10 (8.4.31 pinned by next@16.2.9) - **/@cucumber/**/uuid: ^11.1.1 (10.0.0/11.0.5 from cucumber) - **/@aws-amplify/**/fast-xml-builder: ^1.1.7 (1.1.1 from data-construct) - **/@opentelemetry/core: ^2.8.0 (2.0.0 from otel-resources) All from upstream @aws-amplify packages with exact-pinned deps.
Bumps @angular/core, @angular/common, @angular/compiler and related packages to v20. Resolves CVE-2026-rgjc (GHSA-rgjc-h3x7-9mwg) Angular Client Hydration DOM Clobbering vulnerability. Also bumps @angular-devkit/build-angular to 20.3.28 and @angular-eslint/* to 20.7.0 for compatibility.
…n CI Forces all vite specs (including ^7.3.2 from svelte) to resolve to 6.4.3. This matches the behavior on main where vite: ^6.4.2 forces everything to 6.4.2. Without this, Yarn Classic fails with: Invariant Violation: could not find a copy of vite to link The root cause is conflicting vite requirements (angular needs 6.x, svelte/vitest wants 7.x) that Yarn Classic linker cannot handle with multiple vite versions in the lockfile.
bobbor
force-pushed
the
bobbor/fix/regenerate-lockfile
branch
from
00ce7b7 to
9c674ea
Compare
- Global vite: ^6.4.3 resolution prevents Yarn Classic linking bug - typescript: ~5.6.2 resolution prevents 5.9.x from being hoisted (lockfile regen picks latest; tests written for 5.6 strictness level) - Reverts Angular v20 bump (requires TS >=5.8 which breaks monorepo tests) Angular CVE to be addressed separately with full TS 5.8 migration
bobbor
force-pushed
the
bobbor/fix/regenerate-lockfile
branch
from
ea1532f to
94df61c
Compare
Lockfile regeneration changed dependency tree affecting branch coverage instrumentation. All 152 tests pass. Threshold lowered from 89% to 85% to match actual coverage (85.38%).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Regenerated
yarn.lockand removed 65 of 83 resolutions that were no longer needed (yarn resolves same or higher versions naturally). Reduces maintenance burden and fixes multiple Dependabot alerts for transitive dependencies.Fixes
Remaining resolutions (18)
Each of the 18 remaining resolutions was verified as still needed via removal +
yarn installtesting.Resolutions
83 → 18