Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

USWDS-Compile - POAM: January ‘25 #143

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Conversation

cathybaptista
Copy link

@cathybaptista cathybaptista commented Jan 14, 2025

Summary

Updated vulnerable dependencies and dev dependencies.

Breaking change

This is not a breaking change.

Related issues

USWDS-Team - POAM: January '25
Dependabot undici fix

Major changes

Updated USWDS to 3.11.0

Dependency updates

0 vulnerabilities

Node updates

Dependency name Old version New version
postcss 8.4.49 8.5.1
sass-embedded 1.83.0 1.83.4

Testing instructions

  1. Install this branch on site
  • On Site's main branch, run:

npm install "https://github.com/uswds/uswds-compile/tree/cb-poam-jan-25" --save

  1. Run gulp build scripts and ensure compile runs as expected without error.
  2. Ensure no regressions when package is used to compile site

@cathybaptista cathybaptista changed the title cb: uswds compile dependency fixes. USWDS-Compile - POAM: January ‘25 Jan 14, 2025
@cathybaptista cathybaptista marked this pull request as ready for review January 14, 2025 19:35
@cathybaptista cathybaptista requested a review from a team as a code owner January 14, 2025 19:35
mahoneycm
mahoneycm previously approved these changes Jan 17, 2025
Copy link
Contributor

@mahoneycm mahoneycm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

  • No regressions on site
  • No changes required from updating dependencies
  • No changes required from updated USWDS package

Copy link
Contributor

@mejiaj mejiaj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mahoneycm @cathybaptista can we include work in #144?

Bumps [undici](https://github.com/nodejs/undici) from 6.21.0 to 6.21.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.0...v6.21.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@mahoneycm
Copy link
Contributor

Since we're resolving a dependabot alert here, let's make sure to add a link to the Dependabot issue that it resolves in a related issues section!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants