fix: bump deps, add pnpm overrides#914
Conversation
Update project scripts and dependencies: change the `tauri` script to run `tauri dev`, bump several dependencies (including diff, jspdf, lodash/lodash-es, markdown-it, mermaid, and pin Next to 15.5.12), and add pnpm.overrides for minimatch to enforce safe versions. The pnpm lockfile was regenerated to reflect these upgrades and overrides. These changes address compatibility and security/versioning concerns.
There was a problem hiding this comment.
Pull request overview
Updates dependency versions and adds pnpm overrides to address dependency security/compatibility issues (notably Next.js and minimatch), with a regenerated pnpm lockfile to reflect the new resolutions.
Changes:
- Bump several direct dependencies (e.g., next, jspdf, diff, lodash/lodash-es, markdown-it, mermaid).
- Add
pnpm.overridesto force patched minimatch versions. - Regenerate
pnpm-lock.yamlto apply upgrades/overrides across the dependency graph.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| package.json | Updates dependency versions, pins next to 15.5.12, and adds pnpm.overrides for minimatch. |
| pnpm-lock.yaml | Regenerated lockfile reflecting the dependency bumps and newly added minimatch overrides. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "minimatch@<3.1.3": "3.1.5", | ||
| "minimatch@>=9.0.0 <9.0.6": "9.0.9" |
There was a problem hiding this comment.
The minimatch override ranges don’t fully cover the vulnerable versions listed in the PR description (there are advisories requiring >=3.1.4 and >=9.0.7). Consider widening these to minimatch@<3.1.4 and minimatch@>=9.0.0 <9.0.7 so future dependency resolutions can’t land on 3.1.3 or 9.0.6.
| "minimatch@<3.1.3": "3.1.5", | |
| "minimatch@>=9.0.0 <9.0.6": "9.0.9" | |
| "minimatch@<3.1.4": "3.1.5", | |
| "minimatch@>=9.0.0 <9.0.7": "9.0.9" |
| minimatch@<3.1.3: 3.1.5 | ||
| minimatch@>=9.0.0 <9.0.6: 9.0.9 |
There was a problem hiding this comment.
Same as package.json: the lockfile overrides only target minimatch@<3.1.3 and minimatch@>=9.0.0 <9.0.6, but some advisories require >=3.1.4 and >=9.0.7. Consider updating the override keys to cover <3.1.4 and <9.0.7 to prevent reintroducing vulnerable versions in future lockfile regenerations.
| minimatch@<3.1.3: 3.1.5 | |
| minimatch@>=9.0.0 <9.0.6: 9.0.9 | |
| minimatch@<3.1.4: 3.1.5 | |
| minimatch@>=9.0.0 <9.0.7: 9.0.9 |
| "markdown-it": "^14.1.1", | ||
| "mermaid": "^11.12.3", | ||
| "mitt": "^3.0.1", |
There was a problem hiding this comment.
Upgrading mermaid pulls in langium@4.2.1 (via @mermaid-js/parser@1.0.0) which declares engines node>=20.10.0. If any contributors/CI run installs with Node 18 (still supported by Next 15) or with engine-strict enabled, installs may fail; consider documenting/enforcing the Node requirement via package.json "engines" or pinning mermaid/@mermaid-js/parser to a Node-18-compatible version.
| langium@4.2.1: | ||
| resolution: {integrity: sha512-zu9QWmjpzJcomzdJQAHgDVhLGq5bLosVak1KVa40NzQHXfqr4eAHupvnPOVXEoLkg6Ocefvf/93d//SB7du4YQ==} | ||
| engines: {node: '>=20.10.0', npm: '>=10.2.3'} |
There was a problem hiding this comment.
langium@4.2.1 now has an engines constraint of node >=20.10.0 (and npm >=10.2.3). If the project intends to support Node 18 (which Next 15 still allows), this transitive upgrade (via @mermaid-js/parser@1.0.0) can break installs when engine checks are enforced; consider aligning the repo’s documented/enforced Node version or pinning dependencies to avoid a hard Node 20 requirement.
Fix
Fix
nextjspdfminimatchetc. dependencies issue.Update dependencies: bump several dependencies (including diff, jspdf, lodash/lodash-es, markdown-it, mermaid, and pin Next to 15.5.12), and add pnpm.overrides for minimatch to enforce safe versions. The pnpm lockfile was regenerated to reflect these upgrades and overrides. These changes address compatibility and security/versioning concerns.
Before
After