fix(deps): bump smol-toml and markdownlint-cli - #933
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [smol-toml](https://github.com/squirrelchat/smol-toml) to 1.7.2 and updates ancestor dependency [markdownlint-cli](https://github.com/igorshubovych/markdownlint-cli). These dependencies need to be updated together. Updates `smol-toml` from 1.2.2 to 1.7.2 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.2.2...v1.7.2) Updates `markdownlint-cli` from 0.41.0 to 0.49.1 - [Release notes](https://github.com/igorshubovych/markdownlint-cli/releases) - [Commits](igorshubovych/markdownlint-cli@v0.41.0...v0.49.1) --- updated-dependencies: - dependency-name: smol-toml dependency-version: 1.7.2 dependency-type: indirect - dependency-name: markdownlint-cli dependency-version: 0.49.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
✅ Deploy Preview for phillips-seldon ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![phillips-pr-review-agent[bot]](https://avatars.githubusercontent.com/u/12517380?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependency bump: markdownlint-cli@0.41.0 → 0.49.1 + smol-toml@1.2.2 → 1.7.2
Security context — why this bump matters
smol-toml carries two patched CVEs that are fixed by this update:
- GHSA-v3rj-xjv7-4jmq (v1.6.1): stack overflow via attacker-controlled TOML with thousands of consecutive commented lines — fixed in 1.6.1.
- GHSA-7w5x-hrqm-74c2 (v1.7.1): additional security advisory — fixed in 1.7.1.
Both are devDependencies, so the blast radius is limited to build/lint tooling, not the published package. The update is still the right call.
❌ Blocking issue: lint.yml pins Node.js to 18.x
The new markdownlint-cli@0.49.1 (and its transitive deps) require Node ≥ 22:
| Package | Old engine requirement | New engine requirement |
|---|---|---|
markdownlint-cli |
>=18 |
>=22 |
markdownlint |
>=18 |
>=22 |
ini (in run-con) |
^14.17.0 || ^16.13.0 || >=18 |
^22.22.2 || ^24.15.0 || >=26.0.0 |
commander@15 (top-level) |
>=18 |
>=22.12.0 |
.nvmrc is already pinned to v22.23.1 — build.yml and test.yml correctly use node-version-file: '.nvmrc'. But lint.yml hardcodes node-version: '18.x' and does not reference .nvmrc. With Node 18 the npm ci step will succeed (npm doesn't enforce engine ranges by default), but if markdownlint or any transitive dep uses a Node ≥ 22 API at runtime, the lint step will fail or silently misbehave.
Fix: change lint.yml to use node-version-file: '.nvmrc' (same pattern as build.yml and test.yml):
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version-file: '.nvmrc'
cache: 'npm'This PR should not be merged until either:
lint.ymlis updated to use Node 22 (preferred — aligns with.nvmrc), or- The team confirms that CI runs markdownlint on Node ≥ 22 via another mechanism.
Non-blocking observations
New heavy transitive deps (katex, the full micromark family): markdownlint 0.41.x replaces its custom markdownlint-micromark shim with the full upstream micromark stack and adds micromark-extension-math + katex for math block support. All devDependencies — zero production/bundle impact on the published @phillips/seldon package.
deep-extend promoted to direct dep of markdownlint-cli (was already an indirect dep via run-con). No concern.
dequal loses its "peer": true lockfile marker — it becomes a regular devDependency instead of a peer. Harmless.
Summary
I would request changes. The security fixes in smol-toml are worth landing quickly, but lint.yml must be updated to Node 22 before merging — otherwise the lint CI job will run the new markdownlint toolchain under an unsupported Node version. The fix is a one-line change in lint.yml.
|
Tip All tests passed and all changes approved!🟢 UI Tests: 490 tests unchanged |
|
🚀 Storybook preview is ready. • Preview: undefined |
Dependency Upgrade Risk Assessment:
|
1 participant
Bumps smol-toml to 1.7.2 and updates ancestor dependency markdownlint-cli. These dependencies need to be updated together.
Updates
smol-tomlfrom 1.2.2 to 1.7.2Release notes
Sourced from smol-toml's releases.
... (truncated)
Commits
19239d0chore: bump version5f55c3achore: revert sourcemap publishing5c26f1bchore: update benchmarks92832d2refactor: better logic orchestration in structs2fb9ab8refactor: ctx object instead of pointer arg + tuple returnse6017c4ci: use staged publish3e978a9chore: bump versions30f5c36chore: add some@internalannotationsf0e0399chore(README.md): npmx, use star importa62f06frevert: keep using vite 7Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for smol-toml since your current version.
Updates
markdownlint-clifrom 0.41.0 to 0.49.1Release notes
Sourced from markdownlint-cli's releases.
... (truncated)
Commits
5b5dddcBump version 0.49.14e83bddBump run-con from 1.3.2 to 1.3.34f2127bBump actions/setup-node from 6 to 7cc62492Manually address new violations reported by xo.678b7eeBump xo from 3.0.2 to 4.0.006602e9Bump ignore from 7.0.5 to 7.0.6eac32ddBump markdownlint from 0.41.0 to 0.41.12864eb0Bump js-yaml from 5.2.0 to 5.2.12748661Bump markdown-it from 14.2.0 to 14.3.00144ebeManually address new violations reported by xo.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.