wangzhigang1999 commented on PR #7534:
URL: https://github.com/apache/kyuubi/pull/7534#issuecomment-4852733482
Once this PR is merged, the following Dependabot web-ui security bumps
become redundant and can be closed — each affected package is either removed
from the tree or already at/above the patched version
here:
- #7514 form-data — no longer in the dependency tree
- #7470 @tootallnate/once — no longer in the dependency tree
- #7353 @tootallnate/once + jsdom — @tootallnate/once removed; jsdom
bumped to 26
- #7423 postcss — now 8.5.16 (≥ 8.5.12)
- #7376 lodash — now 4.18.1 (via pnpm overrides)
- #7375 lodash-es — now 4.18.1 (via pnpm overrides)
- #7336 rollup — no longer in the tree (vite 8 uses rolldown)
Still open and intentionally not covered here — dev-only transitive deps of
ESLint 8, to be resolved by the follow-up ESLint 9 (flat-config) upgrade: #7532
(js-yaml), #7340 (ajv), #7364 (flatted), #7338
(minimatch).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
