Repository navigation
Address Platforms/emscripten/browser_test/package-lock.json Dependabot alerts #158395
Description
Dependabot is currently reporting a few vulnerabilities in Platforms/emscripten/browser_test/package-lock.json.
These alerts are separate from the regular updates listed in dependabot.yml.
There are 5 solutions to this problem:
- manually update those deps and fix the alerts;
- manually ask dependabot to create security updates for each alert (like 1);
- manually dismiss the alert;
- configure Dependabot to check and create PRs to update the deps in
package-lock.json; - configure Dependabot to ignore
package-lock.json(if possible);
If we decide to go with 1/2/3, we would need to manually intervene for any future alert, so 4/5 are better solutions in the long term. If we go with 4/5 it should be enough to list the main branch in dependabot.yml to solve the alerts since Dependabot only looks at the main branch, unless we want to update deps on maintenance branches and/or keep all branches aligned.
@hoodmane, do you have any preference?
Activity
freakboy3742 commentedon Sep 30, 2026
FWIW, my preference would be 4/5 - automated processes for this sort of thing are always preferable. If there's an option to have that automatically for maintenance branches as well, then all the better; but I'm not sure if that breaks any other tooling around tracking back ports.
hoodmane commentedon Sep 30, 2026
I agree that not having to manually update the dependencies would be great and backporting them is also preferable.
gh-158395: Add Dependabot npm dependency updates for emscripten (#159234
ezio-melotti commentedon Oct 13, 2026
I merged gh-159234 which resulted in 3 PRs:
I merged the first, but this didn't resolve any of the 3 remaining Dependabot alerts. The 4th was manually fixed in gh-158394 on
main, but the PRs for 3.15/3.14 don't includefollow-redirectsbumps. I'm currently investigating how to solve this.