From 122ea489a037dca71328f836e58b712442473080 Mon Sep 17 00:00:00 2001 From: Lloyd Evans Date: Thu, 8 Oct 2026 21:37:55 +0100 Subject: [PATCH 1/3] Update three transitive dependencies with audit fixes brace-expansion 5.0.12, fast-uri 3.1.8 and source-map-js 1.2.2, each within the range its dependent allows. --- package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index fa3125f..7274cbd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2689,9 +2689,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { @@ -3660,9 +3660,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "dev": true, "funding": [ { @@ -5368,9 +5368,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, "license": "BSD-3-Clause", "engines": { From 6c7b1cff5d1d25a3f2da34919832a60b5c450034 Mon Sep 17 00:00:00 2001 From: Lloyd Evans Date: Thu, 8 Oct 2026 21:41:53 +0100 Subject: [PATCH 2/3] Key the handlebars override on the version it replaces It now applies only to a request for exactly 4.7.9, so it stops applying once the boundaries plugin asks for another version. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f99826d..a77a8c9 100644 --- a/package.json +++ b/package.json @@ -57,6 +57,6 @@ "@example/greeter": "*" }, "overrides": { - "handlebars": "4.7.10" + "handlebars@4.7.9": "4.7.10" } } From 7afb0b249c3c72467c37ffc24d9ec02ccd8d0296 Mon Sep 17 00:00:00 2001 From: Lloyd Evans Date: Thu, 8 Oct 2026 21:45:24 +0100 Subject: [PATCH 3/3] Move dependencies above devDependencies in the manifest --- package.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index a77a8c9..98a7609 100644 --- a/package.json +++ b/package.json @@ -17,6 +17,9 @@ "mutation": "npx --no-install stryker run stryker.config.mts --incremental", "verify-gate": "npm audit --audit-level=critical && npm run lint && npm run format-check && npm run typecheck && npm test && npm run build" }, + "dependencies": { + "@example/greeter": "*" + }, "devDependencies": { "@eslint/js": "^10.0.1", "@stryker-mutator/core": "^10.0.0", @@ -53,9 +56,6 @@ "workspaces": [ "packages/*" ], - "dependencies": { - "@example/greeter": "*" - }, "overrides": { "handlebars@4.7.9": "4.7.10" }