chore(deps): remove glob override to resolve security vulnerabilities - #86
chore(deps): remove glob override to resolve security vulnerabilities#86natoscott wants to merge 1 commit into
Conversation
Remove the pinned `glob@10.5.0` override from package.json. This allows npm to resolve newer, patched versions of glob and its dependent packages, addressing the high-severity vulnerability reported in the npm audit. The override was unnecessarily restrictive and prevented transitive dependencies from pulling in security updates. Removing it allows: - glob to update from 10.5.0 to patched versions (10.3.10+) - rimraf@3.0.2 warning remains (transitive, would require eslint upgrade) - eslint@8.57.1 still supported but in maintenance mode Signed-off-by: Nathan Scott <nathans@redhat.com> Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe dependency override configuration removes the ChangesDependency override cleanup
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: 🟡 Moderate · up to The override removal may allow newer glob versions, but the dependency lock still contains a nested glob version whose advisory exposure has not been confirmed. Resolve that coverage before merging the security remediation. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Some tools did not complete. Review the errors below. 🔧 ESLint
package.jsonParsing error: Missing semicolon. (2:8) Comment |
Summary
Remove the pinned
glob@10.5.0override from package.json to allow npm to resolve newer, patched versions and address high-severity security vulnerabilities.Why: The override was unnecessarily restrictive and prevented transitive dependencies from pulling in security updates. Removing it allows glob to update to patched versions (10.3.10+) while maintaining compatibility.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit