{{ message }}
Repository navigation
Commit 08918c7
committed
chore(deps) docs: re-resolve the mermaid toolchain lockfile
why: the 13 advisories on docs/pnpm-lock.yaml do not all have an
in-range fix, and `pnpm update --depth Infinity` will not shift them:
the lockfile carries resolutions from an older mermaid-cli graph, and
pnpm keeps an existing resolution that still satisfies its range
rather than re-deriving it. Regenerating from the manifest drops the
tree from 538 resolved entries to 398, because cosmiconfig and socks
are absent from mermaid-cli 11.17.0's graph -- and they were the only
paths to js-yaml and ip-address.
Resolved by the package leaving the tree rather than by a bump:
- js-yaml 4.3.0 (high, quadratic CPU in !!omap resolution), reached
only through cosmiconfig
- ip-address 10.2.0 (high, plus mediums), reached only through socks
- extract-zip 2.0.1 (high), which has no patched release published at
all, and goes with the old puppeteer graph
Resolved by moving forward:
- mermaid 11.16.0 -> 11.17.2 (advisory fixed in 11.16.1)
- dompurify 3.4.11 -> 3.4.15 (advisory fixed in 3.4.13)
- puppeteer 24.43.1 -> 25.10.0, following mermaid-cli's own range
what:
- docs/pnpm-lock.yaml regenerated from docs/package.json; no manifest
edit in this commit, lockfileVersion stays 9.01 parent d27bbdd commit 08918c7
1 file changed
Lines changed: 339 additions & 950 deletions
0 commit comments