Skip to content

Update Yarn packages to current releases #195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fulldecent merged 2 commits into from
Oct 14, 2026
Merged

Update Yarn packages to current releases #195

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09ec8e2
Update Yarn packages to the current releases in their existing major …
fulldecent Oct 9, 2026
a379c60
Link the node.js-template URL so markdownlint MD034 passes.
fulldecent Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
approvedGitRepositories:
- "**"

# This makes better-sqlite3 work on GitHub Actions
enableScripts: true

npmMinimalAgeGate: 0
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ Or install the toolchain on the host:
yarn install
```

For a Node.js module or command-line tool, start from https://github.com/fulldecent/node.js-template.
For a Node.js module or command-line tool, start from [node.js-template](https://github.com/fulldecent/node.js-template).

`yarn build:jekyll` and `yarn dev` run Jekyll through `rv run bundle exec`. A `bundle` taken from Homebrew uses a different Ruby than [.ruby-version](.ruby-version) and fails looking for `exe/bundle`.

Expand Down Expand Up @@ -174,7 +174,7 @@ A change that needs a server at request time is outside this site. The page is f
1. This project is released under the [MIT license](./LICENSE.md).
1. [EditorConfig](.editorconfig) and the top of [.gitignore](.gitignore) are taken from project-template release 1.3.0. The rules that follow are `/build`, `/cache`, and `/.yarn`, then [GitHubPages.gitignore](https://github.com/github/gitignore/blob/main/GitHubPages.gitignore) and [Node.gitignore](https://github.com/github/gitignore/blob/main/Node.gitignore). The Node paste repeats the `.env` lines.
1. Prettier runs through Yarn. [.prettierrc.js](.prettierrc.js) loads `@shopify/prettier-plugin-liquid` with `require.resolve`, which Yarn PnP resolves. Markdown uses [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) and [.markdownlint-cli2.yaml](.markdownlint-cli2.yaml), which extends `markdownlint/style/prettier` and limits `no-duplicate-heading` to siblings.
1. `.yarnrc.yml` sets `enableScripts` so `better-sqlite3` can build, `npmMinimalAgeGate` to 0, and `approvedGitRepositories` to `"**"`. [Yarn: Security](https://yarnpkg.com/features/security)
1. `.yarnrc.yml` sets `npmMinimalAgeGate` to 0 and `approvedGitRepositories` to `"**"`. [Yarn: Security](https://yarnpkg.com/features/security)
1. We use the github-pages gem. GitHub Pages [builds with the versions on pages.github.com](https://pages.github.com/versions/) and ignores `Gemfile.lock`, which is why that file is gitignored. [pages-gem issue 768](https://github.com/github/pages-gem/issues/768)
1. For Mac, [OrbStack](https://orbstack.dev/) runs the dev container. [Colima](https://github.com/abiosoft/colima?tab=readme-ov-file#installation) is an open-source Docker host and is about 5x slower for this workload.

Expand Down
23 changes: 16 additions & 7 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,22 +36,31 @@
"- @yarnpkg/sdks depends on @yarnpkg/core ^4.9.1.",
"- 4.9.2 declares got as a patch file under ~/.yarn/patches that exists only in the Yarn repository.",
"- yarn dlx @yarnpkg/sdks fails with ENOENT on that patch. https://github.com/yarnpkg/berry/issues/7281",
"- resolutions pins @yarnpkg/core to 4.9.1, and postinstall runs the local sdks binary."
"- resolutions pins @yarnpkg/core to 4.9.1, and postinstall runs the local sdks binary.",
"",
"Transitive security overrides:",
"- ajv, brace-expansion, fast-uri, and undici are pinned in resolutions.",
"- html-validate and cheerio already allow these releases, and Yarn had locked older vulnerable ones.",
"- ajv 8.20.0, brace-expansion 5.0.12, fast-uri 3.1.8, undici 7.30.0."
],
"license": "MIT",
"devDependencies": {
"@fulldecent/nice-checkers-plugin": "^1.3.8",
"@shopify/prettier-plugin-liquid": "^1.11.0",
"@fulldecent/nice-checkers-plugin": "^1.3.11",
"@shopify/prettier-plugin-liquid": "^1.11.2",
"@yarnpkg/sdks": "^3.3.1",
"cheerio": "^1.2.0",
"css": "^3.0.0",
"glob": "^13.0.6",
"html-validate": "^11.15.0",
"markdownlint-cli2": "^0.23.2",
"prettier": "^3.9.6"
"html-validate": "^11.16.2",
"markdownlint-cli2": "^0.23.3",
"prettier": "^3.9.9"
},
"resolutions": {
"@yarnpkg/core": "4.9.1"
"@yarnpkg/core": "4.9.1",
"ajv": "8.20.0",
"brace-expansion": "5.0.12",
"fast-uri": "3.1.8",
"undici": "7.30.0"
},
"scripts": {
"lint": "sh -c 'yarn lint:prettier \"$@\" && yarn lint:markdown \"$@\"' --",
Expand Down
Loading
Loading