8000 fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts by dominicusin · Pull Request #426 · dominicusin/dominicusin.github.io · GitHub
[go: up one dir, main page]
Skip to content

fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts #426

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dominicusin merged 1 commit into from
Sep 9, 2026
Merged

fix: update svgo, colord, postcss-svgo to resolve Dependabot alerts #426

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 44 additions & 26 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@
"collect-v8-coverage": "^1.0.3",
"color-convert": "^3.1.3",
"color-name": "^2.1.1",
"colord": "^2.9.3",
"colord": "^2.10.0",
"commander": "^15.0.0",
"concat-map": "^0.0.2",
"convert-source-map": "^2.0.0",
Expand Down Expand Up @@ -397,7 +397,7 @@
"postcss-reduce-initial": "^8.0.3",
"postcss-reduce-transforms": "^8.0.3",
"postcss-selector-parser": "^7.1.5",
"postcss-svgo": "^8.0.4",
"postcss-svgo": "^9.0.2",
@qodo-code-review qodo-code-review Bot Sep 9, 2026
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Css tooling has an invalid dependency tree 🐞 Bug ☼ Reliability

postcss-svgo@9.0.2 declares postcss ^8.5.28 as its peer, while the lockfile retains
postcss@8.5.26. Installs only succeed because .npmrc disables peer enforcement, so environments
that enforce peer contracts can reject the tree and the CSS optimizer runs against an unsupported
version.
Agent Prompt 
## Issue description
`postcss-svgo@9.0.2` requires `postcss ^8.5.28`, but the repository still locks PostCSS 8.5.26. Update PostCSS and regenerate the lockfile so the dependency tree satisfies the plugin's peer contract without relying on legacy peer handling.

## Issue Context
The root PostCSS range begins at 8.5.26, and the current lockfile resolves that exact version. `.npmrc` currently masks the mismatch with `legacy-peer-deps=true`.

## Fix Focus Areas
- package.json[373-373]
- package-lock.json[19711-19714]
- package-lock.json[20142-20145]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

"postcss-unique-selectors": "^8.0.3",
"postcss-value-parser": "^4.2.0",
"prelude-ls": "^1.2.1",
Expand Down Expand Up @@ -445,7 +445,7 @@
"stylehacks": "^8.0.3",
"supports-color": "^11.0.0",
"supports-preserve-symlinks-flag": "^1.0.0",
"svgo": "^4.0.2",
"svgo": "^4.1.0",
"symbol-tree": "^3.2.4",
"test-exclude": "^8.0.0",
"text-table": "^0.2.0",
Expand Down
Loading
0