boardgameio / boardgame.io / 30731313879

100%

master: 100%

push

github

chore(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#1314)

v5 drops update-notifier, which is what pulled in got 9 through
latest-version and package-json. That closes the "Got allows a redirect to
a UNIX socket" alert, which no override could fix: package-json 6.5.0 calls
got with the v9 `json: true` option that got 11 rejects, so pinning got
forward would have broken the update check instead of the vulnerability.

The bundled docsify dependency goes 4 to 5 with it, but that does not reach
the site — docs/documentation/index.html loads the browser runtime from
//unpkg.com/docsify@4. Here the CLI is only a static file server with
livereload.

Co-authored-by: Rupesh Pandey <pandeyrupesh00@gmail.com>

2038 of 2038 branches covered (100.0%)

Branch coverage included in aggregate %.

2918 of 2918 relevant lines covered (100.0%)

26359.16 hits per line