[gwynne]

Rollup Plugin Name: node-resolve

This PR contains:

• bugfix
• feature
• refactor
• documentation
• other

Are tests included?

• yes (bugfixes and features will not be merged without tests)
• no

Breaking Changes?

• yes (breaking changes will not be merged unless absolutely necessary)
• no

If yes, then include "BREAKING CHANGES:" in the first commit message body, followed by a description of what is breaking.

List any relevant issue numbers:

Description

As a result of the bogus advisory GHSA-gcqx-w48m-w2h4, npm audit now reports "2 low security vulnerabilities" due to the deepmerge dependency used by the node-resolve plugin. The upstream maintainer has stated they will not be releasing a fix, as there is no actual vulnerability. However, since the only use of deepmerge by node-resolve is a single invocation which can be easily handled manually, my suggested solution, as implemented in this PR, is to take the opportunity to reduce the plugin's dependency count.

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; the lockfile mismatch is fixed.

_{Reviews (3) · Last reviewed commit: "update pnpm-lock.yaml hopefully correctl..." · Reviewed by Greptile}