build(deps): bump vite, ws, js-yaml, esbuild, @babel/core in /frontend - #734
Merged
Conversation
Closes six Dependabot advisories that had no automated PR because all but vite are transitive and not expressible as direct bumps: vite 7.3.1 -> 7.3.6 3 high ws 8.19.0 -> 8.21.3 1 high js-yaml 4.1.1 -> 4.3.0 1 high esbuild 0.27.3 -> 0.28.1 1 low @babel/core 7.29.0 -> 7.29.7 1 low storybook moves 10.2.10 -> 10.5.7 as a prerequisite: 10.2.10 caps esbuild at ^0.27.0, so 0.28.1 was unreachable until storybook widened the range. That is within the declared ^10.2.10, so only the vite range changed in package.json. Verified with npm ci, vite build and tsc --noEmit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
storybook 10.5.7 types action() as returning any, so the concise arrow bodies tripped @typescript-eslint/no-unsafe-return. Wrapping the calls in block bodies discards the return value and restores the void contract the onSelect/onClick props expect. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes six open Dependabot advisories that had no automated PR. All but
viteare transitive, so Dependabot could not express them as direct version bumps.server.fs.denybypass with queries;server.fs.denybypass on Windows alternate pathssourceMappingURLWhy storybook moves too
storybook@10.2.10caps esbuild at^0.27.0, which put the fixedesbuild@0.28.1out of reach.storybook@10.5.7widened that to include^0.28.0, and it satisfies the already-declared^10.2.10, so nopackage.jsonchange was needed for it. This is the bulk of the lockfile diff.package.jsonchanges by exactly one line —vitefrom^7.3.1to^7.3.5.Verification
npm ci,npm run buildandnpx tsc --noEmitall pass locally on this lockfile.Scope
frontend/yarn.lockis deliberately untouched — npm rewrites it as a side effect of any install, andrelease.yamlalready discards those changes viagit checkout frontend/yarn.lock.Remaining known-vulnerable dependency after this lands:
oras.land/oras-go/v22.6.0 (2 high), on the Go side.🤖 Generated with Claude Code