Skip to content

fix: remediate remaining dependency vulnerabilities - #3237

Open
robgruen wants to merge 1 commit into
mainfrom
dev/robgruen/updates_oct
Open

robgruen wants to merge 1 commit into
mainfrom
dev/robgruen/updates_oct

Conversation

@robgruen

Copy link
Copy Markdown
Collaborator

Summary

  • Resolves the 9 non-MSAL S360 dependency alerts; MSAL is handled separately in Update msal-browser to latest version #3232.
  • Updates Electron 41.10.7, MCP SDK 1.32.0 with all direct minimums raised, Vue/server-renderer 3.5.44, and ProseMirror View 1.42.6/model 1.25.12.
  • Preserves the frozen lockfile and age policy, and adds vulnerable-range, standalone-version, and Node16/ESM compatibility regression coverage.

Testing

  • Node 24.22.1; affected 96-package/239-task build.
  • 2,511 Node/Jest tests plus 77 MCP policy assertions passed; 12 pre-existing dispatcher tests skipped.
  • Pinned Prettier; committed lint and complexity including the new test, and circular/debt gates passed.

Update Electron, MCP SDK, Vue server renderer, and ProseMirror to patched versions. Raise standalone SDK minimums and add dependency security and import compatibility regression checks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@robgruen robgruen changed the title fix: remediate remaining S360 dependency vulnerabilities fix: remediate remaining dependency vulnerabilities Oct 27, 2026
@robgruen
robgruen enabled auto-merge October 27, 2026 23:55
@robgruen
robgruen added this pull request to the merge queue Oct 28, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants