Repository navigation
deps: refresh @redocly/openapi-core and bump fast-xml-parser (M12) - #284
Merged
Merged
Conversation
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.11.1 to 5.12.0. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.11.1...v5.12.0) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.12.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
ben-harris-5
previously approved these changes
Nov 11, 2026
ben-harris-5
left a comment
ben-harris-5
left a comment
Member
There was a problem hiding this comment.
Don't like this - would rather upgrade other dependencies to remove the 4.3.1 dep. But this does work, so 🐟
… 1.34.24 lockfile refresh
RGood
changed the title
Collaborator
Author
|
Reworked per Ben's feedback: the |
ben-harris-5
approved these changes
Nov 11, 2026
ben-harris-5
left a comment
ben-harris-5
left a comment
Member
There was a problem hiding this comment.
NICE. Same thing maybe for tinypool?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two open Dependabot alerts in
devvit-docs(M12) without anyresolutionsoverride. Only changes that fix an open alert are included.@redocly/openapi-core(1.34.19 → 1.34.24, same^1.4.0range)fast-xml-parser5.11.1 → 5.12.0 (from Dependabot #280)Details
@redocly/openapi-core1.34.19 pinnedjs-yamlto exactly4.3.1. Every release from 1.34.20 onward depends onjs-yaml4.3.2 (latest 1.x is 1.34.24). The lockfile was simply stuck on 1.34.19, soyarn up -R @redocly/openapi-coreresolves the fix inside the existing range.package.jsonis unchanged.js-yaml@npm:4.3.1to 4.3.2 throughresolutions; thanks @ben-harris-5 for pushing for the cleaner fix. The override has been removed (package.jsonis identical tomain).js-yamlentry (4.3.2) used by all 10 dependents.fast-xml-parser5.12.0 also updates its own dependencies within their ranges (@nodable/entities,fast-xml-builder,is-unsafe,strnum).js-yaml5.5.0, a major bump) is not needed for the alert.yarn install --immutablepasses.Testing
CI
buildshould pass. After merge, confirm the Pages deploy succeeds and that #107 and #160 close.Not included (separate)
tinypoolcritical alerts v0.13.5 release #137/fix 404 #138: see deps: force tinypool 2.1.2 to fix critical alerts (M12) #285.Part of M12 (fix dependency alerts).