FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix: bump vitepress-plugin-llms to resolve dependabot alerts by sriramveeraghanta · Pull Request #482 · makeplane/docs · GitHub

/ docs Public

fix: bump vitepress-plugin-llms to resolve dependabot alerts - #482

Open
sriramveeraghanta wants to merge 1 commit into
masterfrom
fix/dependabot-alerts-llms-deps
ConversationCommits (1)ChecksFiles changed
Open

fix: bump vitepress-plugin-llms to resolve dependabot alerts#482
sriramveeraghanta wants to merge 1 commit into
masterfrom
fix/dependabot-alerts-llms-deps

Conversation

sriramveeraghanta commented Jul 29, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary

Resolves the two open high-severity dependabot alerts:

Both were transitive dependencies of vitepress-plugin-llms@1.13.1 (via markdown-it and minimatch). Bumping the plugin to ^1.13.4 pulls in patched versions:

  • markdown-it 14.3.0 → linkify-it 5.0.2
  • minimatch 10.2.6 → brace-expansion 5.0.8

Verification

  • pnpm why linkify-it / pnpm why brace-expansion confirm patched versions, single resolution each
  • pnpm build completes successfully
  • pnpm check:format passes

Summary by CodeRabbit

  • Chores
    • Updated the VitePress LLMs plugin development dependency to version 1.13.4.

fix: bump vitepress-plugin-llms to resolve dependabot alerts
b5d805b 
Updates vitepress-plugin-llms to ^1.13.4, which resolves:
- linkify-it <= 5.0.1 DoS (alert #69) -> 5.0.2
- brace-expansion < 5.0.7 DoS (alert #68) -> 5.0.8

vercel Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs Ready Preview Jul 29, 2026 8:33pm

coderabbitai Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info ⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 179c8da2-3eae-435e-99b2-28362ce779f0

📥 Commits

Reviewing files that changed from the base of the PR and between db4451d and b5d805b.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • package.json
📝 Walkthrough

Walkthrough

The development dependency vitepress-plugin-llms was updated from ^1.13.1 to ^1.13.4 in package.json.

Changes

Development dependency update

Layer / File(s) Summary
Update plugin version
package.json		 Bumps vitepress-plugin-llms from ^1.13.1 to ^1.13.4.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5 ✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the dependency bump and its purpose of resolving Dependabot alerts.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/dependabot-alerts-llms-deps

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL