Skip to content

feat(deps): update 19 dependencies with security fixes#54

Merged
llbbl merged 2 commits into
mainfrom
deps/update-packages
Apr 24, 2026
Merged

feat(deps): update 19 dependencies with security fixes#54
llbbl merged 2 commits into
mainfrom
deps/update-packages

Conversation

@llbbl

@llbbl llbbl commented Apr 24, 2026

Copy link
Copy Markdown
Owner

Summary

  • Patches 3 security vulnerabilities (XSS in astro, cache poisoning in @astrojs/node, allowedTags bypass in sanitize-html)
  • Updates 19 packages total: 3 major, 2 minor, 14 patch
  • All 152 tests pass; linting and TypeScript compilation clean

Changes

Security Fixes

  • astro: 6.1.5 → 6.1.9 — fixes XSS vulnerability
  • @astrojs/node: 10.0.4 → 10.0.6 — fixes cache poisoning vulnerability
  • sanitize-html: 2.17.2 → 2.17.3 — fixes allowedTags bypass

Major Updates

  • marked: 17.0.4 → 18.0.2
  • typescript: 5.9.3 → 6.0.3
  • lucide-react: 0.577.0 → 1.9.0

Minor Updates

  • @types/node: 25.5.2 → 25.6.0
  • happy-dom: 20.8.9 → 20.9.0

Patch Updates

  • @astrojs/react: 5.0.3 → 5.0.4
  • react / react-dom: 19.2.4 → 19.2.5
  • tailwindcss / @tailwindcss/vite: 4.2.2 → 4.2.4
  • @libsql/client: 0.17.2 → 0.17.3
  • @biomejs/biome: 2.4.10 → 2.4.13
  • vitest / @vitest/browser / @vitest/coverage-v8 / @vitest/ui: 4.1.3 → 4.1.5

Configuration

  • tsconfig.json: Added "ignoreDeprecations": "6.0" to suppress TypeScript 6 deprecation warning for baseUrl
  • biome.json: Updated schema URL to match @biomejs/biome 2.4.13

Test plan

  • pnpm test — 152/152 tests pass
  • pnpm lint — no lint errors
  • pnpm exec tsc --noEmit — no TypeScript errors

### Security Fixes
- astro 6.1.5 → 6.1.9 (fixes XSS vulnerability)
- @astrojs/node 10.0.4 → 10.0.6 (fixes cache poisoning vulnerability)
- sanitize-html 2.17.2 → 2.17.3 (fixes allowedTags bypass)

### Major Updates
- marked 17.0.4 → 18.0.2
- typescript 5.9.3 → 6.0.3
- lucide-react 0.577.0 → 1.9.0

### Minor Updates
- @types/node 25.5.2 → 25.6.0
- happy-dom 20.8.9 → 20.9.0

### Patch Updates
- @astrojs/react 5.0.3 → 5.0.4
- react/react-dom 19.2.4 → 19.2.5
- tailwindcss/@tailwindcss/vite 4.2.2 → 4.2.4
- @libsql/client 0.17.2 → 0.17.3
- @biomejs/biome 2.4.10 → 2.4.13
- vitest suite 4.1.3 → 4.1.5

### Configuration
- tsconfig.json: Add ignoreDeprecations: "6.0" for TypeScript 6 compatibility
- biome.json: Update schema version to 2.4.13
@codecov

codecov Bot commented Apr 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.33%. Comparing base (da1c3a9) to head (7a73159).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main      #54   +/-   ##
=======================================
  Coverage   83.33%   83.33%           
=======================================
  Files          11       11           
  Lines         264      264           
  Branches       68       68           
=======================================
  Hits          220      220           
  Misses         26       26           
  Partials       18       18           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@llbbl llbbl changed the title chore(deps): update 19 dependencies with security fixes feat(deps): update 19 dependencies with security fixes Apr 24, 2026
@llbbl llbbl merged commit 478259f into main Apr 24, 2026
4 checks passed
@llbbl llbbl deleted the deps/update-packages branch April 24, 2026 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant