Save releases.json as build artifact for debugging purposes - #184

Merged

wojtekn merged 1 commit into

trunkfrom

add/releses-json-to-build-artifacts

May 29, 2024

wojtekn commented May 29, 2024

Contributor

Proposed Changes

I propose to save releases.json as a build artifact for debugging purposes.

Testing Instructions

Merge and confirm release.json was saved as build step artifact.

Pre-merge Checklist

Have you checked for TypeScript, React or other console errors?


          Save releases.json as build artifact for debugging purposes

743e0df

wojtekn requested a review from a team

May 29, 2024 09:25

wojtekn self-assigned this

AliSoftware approved these changes

View reviewed changes

fluiddot approved these changes

View reviewed changes

wojtekn merged commit ac6e72a into trunk

wojtekn deleted the add/releses-json-to-build-artifacts branch

May 29, 2024 10:01

wojtekn mentioned this pull request

Update dependencies to address Dependabot security alerts #3667

Merged

5 tasks

wojtekn added a commit that referenced this pull request


          Update dependencies to address Dependabot security alerts (#3667)

fef34cb

## Related issues

Closes ~35 open Dependabot security alerts on the repository.

## How AI was used in this PR

Claude identified which Dependabot alerts were fixable via `npm update`
(stale lockfile entries within existing semver ranges) vs. those
requiring direct dep bumps or overrides, then applied all the easy wins
in one shot.

## Proposed Changes

Updates transitive and direct dependencies to their patched versions to
close the majority of open Dependabot security alerts. All updates are
within the existing declared semver ranges of their parent packages — no
breaking changes expected.

| Package | From | To | Alerts closed |
|---------|------|----|---------------|
| `fast-uri` | 3.1.0 | 3.1.2 |
[#210](https://github.com/Automattic/studio/security/dependabot/210),
[#207](https://github.com/Automattic/studio/security/dependabot/207) |
| `@xmldom/xmldom` | 0.8.11 | 0.8.13 |
[#192](https://github.com/Automattic/studio/security/dependabot/192),
[#191](https://github.com/Automattic/studio/security/dependabot/191),
[#190](https://github.com/Automattic/studio/security/dependabot/190),
[#170](https://github.com/Automattic/studio/security/dependabot/170) |
| `brace-expansion` | 1.1.12 | 1.1.15 |
[#168](https://github.com/Automattic/studio/security/dependabot/168) |
| `qs` | 6.14.0 | 6.15.2 |
[#228](https://github.com/Automattic/studio/security/dependabot/228),
[#89](https://github.com/Automattic/studio/security/dependabot/89),
[#110](https://github.com/Automattic/studio/security/dependabot/110) |
| `ip-address` | 10.1.0 | 10.1.1 |
[#199](https://github.com/Automattic/studio/security/dependabot/199) |
| `basic-ftp` | 5.3.0 | 5.3.1 |
[#202](https://github.com/Automattic/studio/security/dependabot/202) |
| `ws` | 8.18.0 | 8.21.0 |
[#224](https://github.com/Automattic/studio/security/dependabot/224) |
| `protobufjs` | 7.5.5 | 7.6.2 |
[#221](https://github.com/Automattic/studio/security/dependabot/221),
[#220](https://github.com/Automattic/studio/security/dependabot/220),
[#217](https://github.com/Automattic/studio/security/dependabot/217),
[#216](https://github.com/Automattic/studio/security/dependabot/216),
[#219](https://github.com/Automattic/studio/security/dependabot/219),
[#218](https://github.com/Automattic/studio/security/dependabot/218),
[#215](https://github.com/Automattic/studio/security/dependabot/215),
[#225](https://github.com/Automattic/studio/security/dependabot/225) |
| `hono` | 4.12.7 | 4.12.23 |
[#211](https://github.com/Automattic/studio/security/dependabot/211),
[#208](https://github.com/Automattic/studio/security/dependabot/208),
[#204](https://github.com/Automattic/studio/security/dependabot/204),
[#203](https://github.com/Automattic/studio/security/dependabot/203),
[#188](https://github.com/Automattic/studio/security/dependabot/188),
[#185](https://github.com/Automattic/studio/security/dependabot/185),
[#184](https://github.com/Automattic/studio/security/dependabot/184),
[#183](https://github.com/Automattic/studio/security/dependabot/183),
[#182](https://github.com/Automattic/studio/security/dependabot/182),
[#181](https://github.com/Automattic/studio/security/dependabot/181),
[#209](https://github.com/Automattic/studio/security/dependabot/209) |
| `@hono/node-server` | 1.19.11 | 1.19.14 |
[#180](https://github.com/Automattic/studio/security/dependabot/180) |
| `lodash` | 4.17.23 | 4.18.1 |
[#172](https://github.com/Automattic/studio/security/dependabot/172),
[#171](https://github.com/Automattic/studio/security/dependabot/171) |
| `@babel/plugin-transform-modules-systemjs` | 7.27.1 | 7.29.7 |
[#212](https://github.com/Automattic/studio/security/dependabot/212) |
| `@anthropic-ai/sdk` | ^0.90.0 | ^0.91.1 |
[#197](https://github.com/Automattic/studio/security/dependabot/197),
[#196](https://github.com/Automattic/studio/security/dependabot/196) |

**Remaining open alerts** are blocked by exact-pinned third-party
packages (`@php-wasm/*`, `@mariozechner/pi-*`, `electron2appx`) or have
no upstream fix (`showdown`). Those require upstream releases to
resolve.

## Testing Instructions

- [ ] `npm run typecheck` passes
- [ ] `npm test` passes
- [ ] App starts and sites load normally

## Pre-merge Checklist

- [x] No direct dependency version constraints changed (all updates are
lockfile-only except `@anthropic-ai/sdk` range bump)
- [x] `@wp-playground/*` and `@php-wasm/*` pins untouched

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment