mirrors/ruff

0 Fork 0

mirror of https://github.com/astral-sh/ruff.git synced 2026-10-28 10:45:37 +08:00

Files

T

History

Alex Waygood 29057bdbe0 Update playground API Wrangler dependencies (#29529 )

The playground API lockfile contains vulnerable versions of `sharp` and
`undici` through Wrangler and directly declared Miniflare packages. The
older Miniflare packages also bring in vulnerable `picomatch` and
`cross-spawn` versions. Remove the unused direct Miniflare packages and
update Wrangler within its existing version range. This removes those
`picomatch` and `cross-spawn` copies and updates `sharp` and `undici` to
fixed versions.

Change the API's deploy script to `wrangler deploy` because the updated
Wrangler no longer supports `wrangler publish`.

Codex's analysis is that Renovate's missing [support for targeted
updates of transitive dependencies in
`package-lock.json`](https://github.com/renovatebot/renovate/issues/46379)
may explain why it did not open security updates for the vulnerable
transitive dependencies.

Split from #29518.

2026-10-20 16:09:30 -07:00