fix: backport #21238 (update dependabot dependencies) to v4#21330
fix: backport #21238 (update dependabot dependencies) to v4#21330AztecBot wants to merge 1 commit intobackport-to-v4-stagingfrom
Conversation
Ref: A-459 1. barretenberg/docs had a broken resolution `"@docusaurus/mdx-loader/image-size": "1.2.1"` (added in PR #17462) that never worked. Changed to `"@docusaurus/**/image-size": "1.2.1"` which is the correct yarn v1 syntax. 2. barretenberg/docs/yarn.lock required `yarn --ignore-scripts` to save lockfile changes. The regular `yarn` fails on netlify's postinstall script (`@netlify/dev-utils` export error on Node.js v24), which prevents the lockfile from being written. This also caused yarn v1 to clean up stale/duplicate entries in the lockfile, resulting in many unrelated changes (~53KB reduction). 3. boxes/yarn.lock still has tar@6.2.1 via tiged@2.12.7 (requests ^6.1.11). 6.2.1 is the latest tar v6. tiged@3.0.0-rc.0 uses tar v7 but is not stable yet. 4. docs/yarn.lock and barretenberg/docs/yarn.lock have ws@7.x via webpack-bundle-analyzer@4.x (from @docusaurus/core). All v4 releases pin ws@^7.3.1. v5 uses ws@^8, but @docusaurus/core pins ^4.10.2. 5. barretenberg/acir_tests/sol-test has a stale package-lock.json with ws@8.5.0. The project is a yarn workspace of acir_tests, so the actual resolution comes from barretenberg/acir_tests/yarn.lock (ws@8.18.3). 6. netlify-cli@24.0.1 (latest) pins fastify to exactly 5.7.4. No newer netlify-cli version is available yet, so fastify cannot be updated until netlify-cli releases a version with fastify 5.8.2+. | yarn.lock path | Package | Old Version | New Version | |----------------|---------|-------------|-------------| | barretenberg/ts/yarn.lock | minimatch | 9.0.5 | 9.0.9 | | barretenberg/ts/yarn.lock | minimatch | 5.1.6 | 5.1.9 | | barretenberg/cpp/src/barretenberg/nodejs_module/yarn.lock | minimatch | 10.1.2 | 10.2.4 | | l1-contracts/yarn.lock | minimatch | 5.1.6 | 5.1.9 | | boxes/yarn.lock | minimatch | 9.0.3 | 9.0.9 | | boxes/yarn.lock | @typescript-eslint/parser | 6.21.0 | 8.56.1 | | boxes/yarn.lock | @typescript-eslint/eslint-plugin | 6.21.0 | 8.56.1 | | barretenberg/ts/yarn.lock | minimatch | 3.1.2 | 3.1.5 | | yarn-project/yarn.lock | node-gyp | 10.1.0 | 12.2.0 | | yarn-project/yarn.lock | tar | 6.2.1 | 7.5.10 | | barretenberg/ts/yarn.lock | node-gyp | 11.2.0 | 12.2.0 | | barretenberg/ts/yarn.lock | tar | 7.4.3 | 7.5.10 | | playground/yarn.lock | node-gyp | 11.2.0 | 12.2.0 | | playground/yarn.lock | tar | 7.4.3 | 7.5.10 | | barretenberg/acir_tests/yarn.lock | node-gyp | 11.1.0 | 12.2.0 | | barretenberg/acir_tests/yarn.lock | tar | 7.4.3 | 7.5.10 | | barretenberg/cpp/src/barretenberg/nodejs_module/yarn.lock | tar | 7.5.7 | 7.5.10 | | docs/yarn.lock | node-gyp | 11.0.0 | 12.2.0 | | docs/yarn.lock | tar | 7.5.1 | 7.5.10 | | boxes/yarn.lock | node-gyp | 11.2.0 | 12.2.0 | | boxes/yarn.lock | tar (node-gyp) | 7.4.3 | 7.5.10 | | barretenberg/docs/yarn.lock | netlify-cli | 17.38.1 | 23.7.3 | | barretenberg/docs/yarn.lock | tar | 6.2.1, 7.4.3 | 7.5.10 | | yarn-project/yarn.lock | glob | 10.3.12 | 10.5.0 | | barretenberg/ts/yarn.lock | glob | 10.4.5 | 10.5.0 | | barretenberg/acir_tests/yarn.lock | glob | 10.4.5 | 10.5.0 | | boxes/yarn.lock | glob | 10.4.5 | 10.5.0 | | docs/yarn.lock | glob | 10.4.5 | 10.5.0 | | barretenberg/docs/yarn.lock | glob | 10.4.5 | 10.5.0 | | yarn-project/yarn.lock | @modelcontextprotocol/sdk | 1.11.2 | 1.27.1 | | playground/yarn.lock | @modelcontextprotocol/sdk | 1.11.2 | 1.27.1 | | yarn-project/yarn.lock | jws | 4.0.0 | 4.0.1 | | docs/yarn.lock | jws | 3.2.2 | 3.2.3 | | barretenberg/docs/yarn.lock | jws | 3.2.2 | 3.2.3 | | docs/yarn.lock | svgo | 4.0.0 | 4.0.1 | | docs/yarn.lock | svgo | 3.3.2 | 3.3.3 | | barretenberg/docs/yarn.lock | svgo | 3.3.2 | 3.3.3 | | docs/yarn.lock | netlify-cli | 23.7.3 | 24.0.1 | | docs/yarn.lock | fastify | 4.29.1 | 5.7.4 | | barretenberg/docs/yarn.lock | netlify | 22.2.2 | 24.0.1 | | barretenberg/docs/yarn.lock | netlify-cli | 23.7.3 | 24.0.1 | | barretenberg/docs/yarn.lock | fastify | 4.29.1, 5.7.3 | 5.7.4 | | barretenberg/docs/yarn.lock | axios | 1.12.2 | 1.13.6 | | barretenberg/docs/yarn.lock | image-size | 1.2.0 | 1.2.1 |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
Closing as duplicate — superseded by a newer attempt. |
3 participants
Summary
Backport of #21238 to v4.
Cherry-picked the merge commit onto
backport-to-v4-stagingwith conflict resolution:14 files changed — mostly lockfile updates for security dependency bumps (minimatch, tar, node-gyp, glob, svgo, jws, etc.).
ClaudeBox log: https://claudebox.work/s/c000f88838e2f218?run=1