Clear esbuild advisories + bump to v0.2.0 for release - #13
Merged
Conversation
esbuild's dev server (which this package never runs => esbuild is only the bundler under tsup) had a medium + a low advisory. a pnpm override collapses the whole tree to a single patched esbuild@0.28.2. tsup 8.5.1 builds fine against it, no tsup bump needed. lockfile regenerated, frozen-lockfile clean.
- root package.json 0.0.0 -> 0.2.0 - scoped alias version + its sql-switch pin -> 0.2.0 (they publish in lockstep) - CHANGELOG 0.2.0 dated to the actual release day
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release prep for v0.2.0.
esbuild advisories (both transitive dev dep, dev-server only, no library impact)
<= 0.24.2, LOW esbuild>= 0.27.3, < 0.28.1.pnpm.overrides.esbuild: ">=0.28.1"collapses the tree to a singleesbuild@0.28.2. tsup 8.5.1 builds fine against it.Version bump (0.0.0 placeholder -> 0.2.0)
package.json,scoped/package.jsonversion, and the scopedsql-switchpin all ->0.2.0(they publish in lockstep).Verified locally
pnpm run build✅ ·pnpm run typecheck✅ ·pnpm install --frozen-lockfile✅. (smoke segfaults in-sandbox — known better-sqlite3 ABI issue, CI on Node 22 covers it.)After merge: tag
v0.2.0fires the Publish workflow (both packages, provenance) viaNPM_TOKEN.🤖 Generated with Claude Code