Summary: Within-range bumps across runtime and dev deps (commander, htmlparser2, eslint/typescript-eslint stack, jest, typescript, @yao-pkg/pkg, etc.) with an expanded resolutions table pinning transitive packages with known advisories (lodash, tar/tmp, minimatch, ajv, glob, js-yaml, and others). CI workflows consistently move from Node 20.x to 22.x, matching the pipeline fix noted on #268.

What looks good:

No major-version jumps in this pass; semver ranges preserved
Lockfile regenerated and snapshot update is cosmetic (Jest header URL only)
Reusable dependency-audit Cursor skill documents the process for future releases
Change set is limited to deps, CI, tooling docs — no application logic edits

Non-blocking: Consider adding an engines.node field in package.json if you want local dev environments to match the Node 22 CI target.

Closes review for #268.

**Approved** — the 2.5.0 dependency audit looks good to merge. **Summary:** Within-range bumps across runtime and dev deps (commander, htmlparser2, eslint/typescript-eslint stack, jest, typescript, @yao-pkg/pkg, etc.) with an expanded `resolutions` table pinning transitive packages with known advisories (lodash, tar/tmp, minimatch, ajv, glob, js-yaml, and others). CI workflows consistently move from Node 20.x to 22.x, matching the pipeline fix noted on #268. **What looks good:** - No major-version jumps in this pass; semver ranges preserved - Lockfile regenerated and snapshot update is cosmetic (Jest header URL only) - Reusable dependency-audit Cursor skill documents the process for future releases - Change set is limited to deps, CI, tooling docs — no application logic edits **Non-blocking:** Consider adding an `engines.node` field in `package.json` if you want local dev environments to match the Node 22 CI target. Closes review for #268.

Vylpes added 1 commit

2026-09-20 13:18:47 +01:00

Add engines.node field

Test / build (push) Successful in 1m36s

Details

6cd6668277

Vylpes dismissed Smithy-bot's review

2026-09-20 13:18:47 +01:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

Vylpes requested review from Smithy-bot

2026-09-20 13:19:18 +01:00

Smithy-bot approved these changes

2026-09-21 12:04:32 +01:00

Smithy-bot left a comment

Approved — follow-up re-review at HEAD 6cd6668.

The new commit adds "engines": { "node": ">=22 && <=24" } to package.json, which addresses the non-blocking suggestion from my prior review and aligns local dev expectations with the Node 22 CI workflows. No other changes since approval.

Summary: The 2.5.0 dependency audit remains solid — within-range bumps, expanded resolutions pins for transitive advisories, lockfile regeneration, and CI on Node 22. The dependency-audit Cursor skill and overview doc are a nice addition for future releases.

Looks good to merge.

**Approved** — follow-up re-review at HEAD `6cd6668`. The new commit adds `"engines": { "node": ">=22 && <=24" }` to `package.json`, which addresses the non-blocking suggestion from my prior review and aligns local dev expectations with the Node 22 CI workflows. No other changes since approval. **Summary:** The 2.5.0 dependency audit remains solid — within-range bumps, expanded `resolutions` pins for transitive advisories, lockfile regeneration, and CI on Node 22. The dependency-audit Cursor skill and overview doc are a nice addition for future releases. Looks good to merge.

Vylpes merged commit b0aabf7766 into release/2.5.0

2026-09-21 13:14:29 +01:00

Vylpes deleted branch feature/268-2-5-0-dependencies

2026-09-21 13:14:29 +01:00

Vylpes referenced this pull request from a commit

2026-09-21 13:14:30 +01:00

Merge pull request '2.5.0 Dependency Updates' (#293) from feature/268-2-5-0-dependencies into release/2.5.0

Commenting is not possible because the repository is archived.

No reviewers