chore: Update picomatch and rollup-plugin-typescript2#9892
chore: Update picomatch and rollup-plugin-typescript2#9892
Conversation
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…h-2.3.2' into ch-picomatch-update
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the version of rollup-plugin-typescript2 to 0.37.0 across multiple packages and includes updates to the yarn.lock file. A critical issue was identified in the yarn.lock changes where the dependencies for sha.js were accidentally removed during entry deduplication, which could lead to installation or runtime errors. It is recommended to regenerate the lockfile to restore these necessary dependencies.
| sha.js@^2.4.0, sha.js@^2.4.12, sha.js@^2.4.8: | ||
| version "2.4.12" | ||
| resolved "https://registry.npmjs.org/sha.js/-/sha.js-2.4.12.tgz#eb8b568bf383dfd1867a32c3f2b74eb52bdbf23f" | ||
| integrity sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w== |
There was a problem hiding this comment.
The dependencies section for sha.js has been removed during the deduplication of entries in the lockfile. sha.js version 2.4.12 requires its dependencies (inherits, safe-buffer, and to-buffer) to be correctly defined to ensure they are installed. Removing them will likely cause installation failures or runtime errors. It is recommended to regenerate the lockfile using yarn install to ensure all transitive dependencies are correctly captured.
sha.js@^2.4.0, sha.js@^2.4.12, sha.js@^2.4.8:
version "2.4.12"
resolved "https://registry.npmjs.org/sha.js/-/sha.js-2.4.12.tgz#eb8b568bf383dfd1867a32c3f2b74eb52bdbf23f"
integrity sha512-8LzC5+bvI45BjpfXU8V5fdU2mfeKiQe1D1gIMn7XUlF3OTUrpdJpPPH4EMAnF0DsHHdSZqCdSss5qCmJKuiO3w==
dependencies:
inherits "^2.0.4"
safe-buffer "^5.2.1"
to-buffer "^1.2.0"
1 participant
Update picomatch for security reasons as per PR #9760
Updating picomatch to 2.3.2 breaks unless
rollup-plugin-typescript2is also updated, so this PR includes that update.