Decide how to clear 28 npm Dependabot alerts that need a direct dependency bump or an override
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 35/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- github, node.js, typescript
调研方向
Start with pnpm-lock.yaml and the dependency declarations for hosted and dor-tools-builtin; the issue names those packages and their version constraints but no source files or tests. Review the linked Dependabot alerts and the listed upstream options, then determine which alerts need a direct upgrade, an override, or dismissal. Done means all 28 alerts have a maintainer decision and the applicable alerts are cleared.
由索引模型根据 Issue 内容生成。
描述
28 of the 58 Dependabot alerts opened on pnpm-lock.yaml on 2026-11-03 can't be cleared by a lockfile-only bump. Each needs a maintainer decision: a direct-dependency upgrade, a pnpm.overrides entry, or a dismissal as not reachable. #1573 clears the other 30. Numbers below are Dependabot alert numbers.
| Package | Pinned by | Fix | Alerts |
|---|---|---|---|
| undici 7.29.0 | [email protected] (direct devDependency of hosted), exact pin |
7.30.1 | 24–33, 49, 51, 53, 57, 59, 61, 63, 65 |
| sharp 0.35.2 | the same miniflare, exact pin | 0.35.5 | 22, 41 |
| dompurify 3.4.15 | [email protected] (latest release), exact pin |
3.4.17 | 38, 40, 42, 43, 44 (44 critical) |
| katex 0.16.47 | mermaid 11.17.2 (^0.16.47) |
0.18.2 | 39 |
| glob 10.5.0 / 13.0.6 | dependents take ^10, ^13.0.1, ~13.0.0 |
14.0.2 | 67 |
| minimatch 5.1.9 / 9.0.9 / 10.2.x | dependents take ^5.1.0, ^9.0.4, ^10.2.2, ^10.2.6 |
11.0.1 | 68 |
Options seen so far:
- miniflare is a dev/test dependency of Hosted, so undici and sharp there don't ship to users. Its
latesttag (4.20260730.0) pins undici 7.28.0, which is also vulnerable, so moving channels doesn't help. - katex clears with mermaid 12.3.0 (
^0.18.0), a major bump of a directdor-tools-builtindependency published 2026-11-03. It becomes adoptable under the 24-hour cooldown on 2026-11-04. - dompurify in monaco, glob, and minimatch have no in-range fix. Clearing them means an override past the dependent's declared range, or waiting for upstream.
- 主要语言
- TypeScript
- 星标
- 5
- 派生
- 1
- 平均合并
- 11 小时 41 分钟
- 30 天内合并 PR
- 432
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
diffplug/dormouse 的其他 Issue
-
tend-ci-failure
难度 3/5 1-2 天 新手友好度 35/100
diffplug/dormouse#1575 · 2 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 18/100
diffplug/dormouse#1572 · 1 条评论 ·
维护者通常 1 天内回复
-
tend-ci-cause
难度 4/5 1-2 天 新手友好度 42/100
diffplug/dormouse#1565 · 1 条评论 ·
维护者通常 1 天内回复
-
red-team
难度 5/5 一周以上 新手友好度 5/100
维护者通常 1 天内回复
-
review-runs-tracking
难度 5/5 一周以上 新手友好度 5/100
diffplug/dormouse#1492 · 1 条评论 ·
维护者通常 1 天内回复
查看 diffplug/dormouse 的全部 Issue
相似的 Issue
-
unwrapDatabaseError masks real DB errors with TypeError: Cannot convert object to primitive value未关闭
难度 2/5 1-3 小时 新手友好度 74/100
NEARBuilders/everything-dev#798 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
vercel-labs/durable-harness#53 ·
维护者通常 1 天内回复
-
[Bug]: Redesign tab bars ignore clicks on Linux: hidden chat layers keep window drag regions可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
experiência: a doc manda subir para o Micro do Supabase, mas não diz que exige plano pago nem quanto custa可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭area/docs area/ui enhancement
难度 1/5 1-3 小时 新手友好度 88/100
melgarafael/DeskcommCRM#4098 ·
维护者通常 1 天内回复
-
dependencies platform: ios
难度 1/5 1-3 小时 新手友好度 78/100
software-mansion/react-native-executorch#1617 ·
维护者通常 1 天内回复