fix(deps): clear 14 remaining dependabot advisories in website#108
Merged
fix(deps): clear 14 remaining dependabot advisories in website#108
Conversation
Sweep of website/ deps to latest within ranges, plus a vite downgrade from 8 -> 7 to match astro's transitive vite (7.3.2) and avoid a rolldown regression with @tailwindcss/vite 4.2.4. Closes alerts #28 #29 #30 #31 #33 #34 #35 #36 #37 #38 #39 #40 #44 #48 covering vite, picomatch, postcss, yaml, astro, smol-toml. - vite ^8.0.1 -> ^7.3.2 (drops the now-redundant vite 8 lineage; astro pulls 7.3.2 transitively, which is the patched version) - astro 6.0.6 -> 6.2.2 (#44) - @tailwindcss/vite 4.2.2 -> 4.2.4 - smol-toml: lockfile bump to 1.6.1 (#28) - postcss: lockfile bump to 8.5.14 (#48) - picomatch: lockfile bumps to 2.3.2 + 4.0.4 (#29 #30 #39 #40) - yaml is now omitted entirely (it was an optional vite peer) Verified: pnpm build succeeds; no @tailwindcss/vite peer-dep warnings.
oxlint 1.63 removed prefer-arrow-callback from the eslint plugin. With the deps bump in this branch (oxlint 1.56 -> 1.63), the rule no longer resolves and `pnpm check` errors out before linting any files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sweep of `website/` dependencies to clear all 14 remaining dependabot advisories. Drops the redundant vite 8 lineage (we already pull patched vite 7.3.2 transitively from astro) to dodge a rolldown regression with `@tailwindcss/vite`.
Closes
#28 #29 #30 #31 #33 #34 #35 #36 #37 #38 #39 #40 #44 #48
Direct dep changes (package.json)
The vite downgrade is the only "non-trivial" change — see context below.
Why downgrade vite from 8 to 7
`pnpm update --latest` pushed vite to 8.0.10 (and the patched-but-still-bumped 8.0.5), both of which fail the build with:
```
[@tailwindcss/vite:generate:build] Missing field `tsconfigPaths` on BindingViteResolvePluginConfig.resolveOptions
```
That's a rolldown regression in vite 8's bundler when paired with `@tailwindcss/vite@4.2.4`. `@tailwindcss/vite`'s peer-dep range covers vite 5–8, so dropping back to 7 is supported. Astro pulls vite 7.3.2 transitively anyway (which is the patched version that closes alerts #36 #37 #38), so the direct devDep just aligns with the version we already use.
Release
The `fix(deps):` commit triggers another patch release (`v0.15.1` -> `v0.15.2`) on merge.
Verified
How to verify