chore: resolve open dependabot security alerts - #31
Merged
Conversation
- undici <6.28.0 -> 6.28.0 (medium, alerts #144, #142, #141) - ip-address <=10.3.0 -> 10.5.0 (high, alert #140) - ip-address >=10.1.1,<=10.2.1 -> 10.5.0 (medium, alert #138) - ip-address >=10.1.1,<=10.2.0 -> 10.5.0 (medium, alert #137) Bumped the npm override to 11.19.1 so the bundled npm dependency tree (pulled in transitively via @semantic-release/npm) picks up patched undici and ip-address instead of the previously overridden versions, which were not actually reaching npm's bundled deps.
There was a problem hiding this comment.
🟡 Changes recommended
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the repository’s npm dependency overrides to address Dependabot security alerts related to transitive dependencies bundled within npm as used by @semantic-release/npm.
Changes:
- Bumps the
npmoverride to11.19.1to ensure npm’s bundled dependency tree includes patched versions (per PR description).
File summaries
| File | Description |
|---|---|
| package.json | Updates the overrides.npm version used transitively by @semantic-release/npm to pull in patched bundled dependencies. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
41
to
+43
| "ip-address": "10.3.1", | ||
| "@semantic-release/npm": "13.1.5", | ||
| "npm": "11.18.0", | ||
| "npm": "11.19.1", |
JamieSinn
approved these changes
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
npmoverride version so the bundled dependency tree pulled in via@semantic-release/npm->npmactually resolves to patchedundiciandip-addressversions.Dependabot Alerts Resolved
undicinpmoverride (11.18.0 -> 11.19.1)undicinpmoverrideundicinpmoverrideip-addressnpmoverrideip-addressnpmoverrideip-addressnpmoverrideNote:
package.jsonalready hadundiciandip-addressoverrides pinned to patched versions, but those overrides did not reach npm's own bundled dependency tree (npm shipsundici/ip-addressasbundleDependencies, which npm overrides cannot touch). Bumping thenpmoverride itself to a version that bundles the patched packages resolves all six alerts.