Skip to content

Audit dependency bump.#695

Merged
wheelsandcogs merged 2 commits into
mainfrom
bump-deps-audit
Jun 9, 2026
Merged

Audit dependency bump.#695
wheelsandcogs merged 2 commits into
mainfrom
bump-deps-audit

Conversation

@wheelsandcogs

@wheelsandcogs wheelsandcogs commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator

Removes jest-junit (wasn't actually used) as it has an audit-flagged uuid version.

Overrides the same flagged uuid version in exceljs with a patched version. This is a forced override as exceljs is no-longer maintained, but it should be fine as the api for uuid v4 has not changed.

Copilot AI review requested due to automatic review settings June 4, 2026 14:42

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses dependency security findings by removing an unused jest-junit dev dependency (which pulled in a flagged uuid version) and forcing exceljs to resolve uuid to a patched major version via npm overrides.

Changes:

  • Add an npm overrides rule to force exceljs to use uuid@^11.1.1.
  • Remove jest-junit from dev dependencies and stop configuring Jest to use it as a reporter.
  • Refresh package-lock.json to reflect the updated dependency graph (including removal of jest-junit and updated transitive resolutions).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File Description
package.json Adds overrides for exceljs -> uuid and removes jest-junit from devDependencies.
package-lock.json Updates the lockfile to remove jest-junit and reflect the new resolved uuid/transitive versions.
jest.config.ts Removes the jest-junit reporter configuration.

@j-maynard j-maynard left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🤘🏻

@wheelsandcogs wheelsandcogs merged commit b84d003 into main Jun 9, 2026
6 checks passed
@wheelsandcogs wheelsandcogs deleted the bump-deps-audit branch June 9, 2026 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants