Skip to content

fix h3#99

Merged
mattcosta7 merged 1 commit intomainfrom
fix-h3-vuln
Mar 30, 2026
Merged

fix h3#99
mattcosta7 merged 1 commit intomainfrom
fix-h3-vuln

Conversation

@mattcosta7
Copy link
Copy Markdown
Member

No description provided.

@mattcosta7 mattcosta7 marked this pull request as ready for review March 30, 2026 21:03
@mattcosta7 mattcosta7 requested a review from a team as a code owner March 30, 2026 21:03
Copilot AI review requested due to automatic review settings March 30, 2026 21:03
@mattcosta7 mattcosta7 enabled auto-merge March 30, 2026 21:03
@mattcosta7 mattcosta7 self-assigned this Mar 30, 2026
@mattcosta7 mattcosta7 temporarily deployed to github-pages-preview March 30, 2026 21:04 — with GitHub Actions Inactive
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates TanStack router/start dependencies for the @github-ui/website workspace and adds an npm overrides entry at the repo root to force h3/h3-v2 to 2.0.1-rc.20, with corresponding package-lock.json updates.

Changes:

  • Bump @tanstack/react-router and @tanstack/react-start versions in packages/website.
  • Add root-level npm overrides to pin h3 and the h3-v2 alias to 2.0.1-rc.20.
  • Refresh package-lock.json to reflect the new dependency/override resolution.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File Description
packages/website/package.json Updates TanStack versions used by the website workspace.
package.json Introduces npm overrides to force a specific h3 / h3-v2 resolution.
package-lock.json Captures the resulting dependency tree/hoisting changes from the updates.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
"node": ">=22"
},
"overrides": {
"h3": "2.0.1-rc.20",
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new repo-wide override for "h3" appears to be unused: the lockfile contains only the aliased "h3-v2" package (installed into node_modules/h3-v2) and no node_modules/h3 entry. If nothing in the dependency tree depends on the package name "h3" directly, consider removing the "h3" override and keeping only the "h3-v2" alias override to reduce override surface area and future surprise upgrades when a direct "h3" dependency is introduced.

Suggested change
"h3": "2.0.1-rc.20",

Copilot uses AI. Check for mistakes.
Comment thread package.json
},
"overrides": {
"h3": "2.0.1-rc.20",
"h3-v2": "npm:h3@2.0.1-rc.20"
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these were pinned in ts/react-start, so we have to override pin them

@mattcosta7 mattcosta7 disabled auto-merge March 30, 2026 21:09
@mattcosta7 mattcosta7 merged commit e00065a into main Mar 30, 2026
14 checks passed
@mattcosta7 mattcosta7 deleted the fix-h3-vuln branch March 30, 2026 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants