yarn.lock: refresh transitive dependencies with open advisories

Browse Source

Lockfile only. 71 open Dependabot alerts; each vulnerable range was checked against yarn.lock and `yarn up -R` moved every package with a fix inside its dependents' ranges; terser-webpack-plugin 5.6 drops serialize-javascript and styled-components 6.5 no longer pins postcss 8.4.49.

Left, with no fix inside range: sprintf-js 1.0.3 (no fixed version exists), fast-xml-parser 4.5.7 (fixed in 5.7; the React Native CLI 12 used by reactnative-identicon asks for ^4), vue 2.7.16 (fixed only in vue 3; vue-identicon's dev dependency).

...

This commit is contained in:

Satoshi Qazi Muhammed authored and SatoshiQaziMuhammed committed 2026-10-10 02:53:27 +04:00

1 parent 53a730f92f

commit a1997e7e3f

1 file changed

+246 -401

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

yarn.lock

+246 -401

File diff suppressed because it is too large. Load diff