Skip to content

chore: resolve open dependabot security alerts#383

Merged
beeme1mr merged 5 commits into
mainfrom
fix/dependabot-alerts
May 4, 2026
Merged

chore: resolve open dependabot security alerts#383
beeme1mr merged 5 commits into
mainfrom
fix/dependabot-alerts

Conversation

@jonathannorris
Copy link
Copy Markdown
Member

@jonathannorris jonathannorris commented Apr 28, 2026

Summary

  • Resolved all 8 open Dependabot security alerts by bumping markdown-link-check to ^3.14.2 and markdownlint-cli to ^0.48.0; lodash.template required an npm override since markdown-tocremarkable@1.7.xautolinker@0.15.xgulp-header is a frozen dep chain
  • markdownlint-cli@0.48.0 introduced MD060 (table column style); fixed pre-existing violations in appendix-d-observability.md and types.md via prettier

- markdownlint-cli ^0.44.0 -> ^0.48.0 (fixes minimatch, glob, js-yaml v4 alerts 18, 12, 8)
- markdown-link-check ^3.10.2 -> ^3.14.2 (fixes basic-ftp alerts 16 and 22)
- js-yaml 3.14.1 -> 3.14.2 (medium, alert 9; resolves naturally via lockfile refresh)
- lodash.template 4.5.0 -> 4.18.1 (high, alerts 1 and 21; override required, markdown-toc dep chain is frozen)

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris jonathannorris force-pushed the fix/dependabot-alerts branch from 8044d72 to 71c7e0e Compare April 28, 2026 20:28
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a series of dependency overrides in package.json to enforce specific versions for packages such as basic-ftp, minimatch, and glob, while also updating package-lock.json with corresponding version bumps and added license metadata. A critical issue was identified in the overrides section where lodash.template is set to a non-existent version (^4.18.0), which will cause installation failures; it is recommended to override the base lodash package to ^4.17.21 instead.

Comment thread package.json
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris jonathannorris requested a review from a team as a code owner April 28, 2026 20:31
Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
This reverts commit 7e3889e.

Signed-off-by: Jonathan Norris <jonathan.norris@dynatrace.com>
@jonathannorris
Copy link
Copy Markdown
Member Author

markdownlint-cli@0.48.0 introduced MD060 (table column style), which enforces consistent pipe alignment in markdown tables. Fixed the pre-existing violations via prettier — if we don't want this rule we can add MD060: false to .markdownlint.yml.

@jonathannorris jonathannorris requested a review from askpt April 29, 2026 13:09
@beeme1mr beeme1mr merged commit 291a5ee into main May 4, 2026
7 checks passed
@beeme1mr beeme1mr deleted the fix/dependabot-alerts branch May 4, 2026 20:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants