Skip to content

[Snyk] Upgrade semver from 7.7.2 to 7.8.5 - #15148

Closed
posit-snyk-bot wants to merge 1 commit into
mainfrom
snyk-upgrade-9d85de7ab35805772031cc19b4607660
Closed

[Snyk] Upgrade semver from 7.7.2 to 7.8.5#15148
posit-snyk-bot wants to merge 1 commit into
mainfrom
snyk-upgrade-9d85de7ab35805772031cc19b4607660

Conversation

@posit-snyk-bot

@posit-snyk-bot posit-snyk-bot commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator

snyk-top-banner

Snyk has created this PR to upgrade semver from 7.7.2 to 7.8.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 8 versions ahead of your current version.

  • The recommended version was released 4 months ago.

Breaking Change Risk

Merge Risk: Low

Notice: This assessment is enhanced by AI.

Release notes
Package name: semver from semver GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
fix: upgrade semver from 7.7.2 to 7.8.5
41f73b2 
Snyk has created this PR to upgrade semver from 7.7.2 to 7.8.5.

See this package in npm:
semver

See this project in Snyk:
https://app.snyk.io/org/open-source-6kz/project/f666fa65-905e-4707-a30f-ba207f18c65d?utm_source=github&utm_medium=referral&page=upgrade-pr
@posit-snyk-bot

posit-snyk-bot commented Oct 22, 2026

Copy link
Copy Markdown
Collaborator Author

Merge Risk: Low

This is a minor version upgrade that, according to semantic versioning principles, should not contain breaking changes. The updates from version 7.7.2 to 7.8.5 consist primarily of bug fixes and dependency updates.

Key Changes:

  • v7.8.5: Fixes an issue with how tilde (~) ranges handle prereleases when the includePrerelease flag is used.
  • v7.8.0 - v7.8.4: Includes minor documentation and dependency updates.
  • v7.7.2: Fixes handling of prerelease identifiers that start with digits and adds 'use strict' directives.

No breaking changes are documented in the release notes for this version range.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@posit-snyk-bot

posit-snyk-bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@cderv

cderv commented Oct 22, 2026

Copy link
Copy Markdown
Member

Closing in favor of #15151. This package.json belongs to the Node-runtime spike in dev-docs/runtime-migration/ — frozen, throwaway evidence tooling whose pinned versions don't flow into shipped quarto code (the real sources get these deps via src/import_map.json / packages/ojs). Merging all 8 spike PRs individually would leave 7 of them conflicted; one representative merge records the "we don't take Snyk bumps here" signal. A request has been filed to disable upgrade PRs for this Project in the Snyk UI.

@cderv cderv closed this Oct 22, 2026
@cderv
cderv deleted the snyk-upgrade-9d85de7ab35805772031cc19b4607660 branch October 22, 2026 12:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@posit-snyk-bot @cderv @snyk-bot