Repository navigation
chore(deps): upgrade Handsontable in its example and the @joint/sanitize build tools, refresh http-cache-semantics - #3570
Merged
Conversation
…cache-semantics Handsontable 18 has no dependencies, so the pinned moment 2.30.1 goes away. Its legacy dist CSS is gone too: the example now loads the base styles with the classic theme, and keeps the header row colour through the theme's read-only cell variable.
rollup 4.36.0 and @rollup/plugin-terser 0.4.4 (through serialize-javascript 6) carried Dependabot alerts. They are dev-only and now match the other packages; the built bundles are byte-identical.
kumilingus
changed the title
Geliogabalus
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears Dependabot alerts held by dev tooling: moment, http-cache-semantics, rollup ×2 and serialize-javascript ×3.
Handsontable example (moment)
handsontable16 pinnedmoment2.30.1.handsontable18 has no dependencies at all, somoment(andnumbro,pikaday,dompurify,core-js,hyperformula, ...) leaves the lockfile.examples/spreadsheet-shapes-with-handsontable-jsis the only workspace using it:^16.2.0→^18.1.2.Adaptations for Handsontable 17+:
handsontable/dist/handsontable.min.cssno longer exists. The example loadshandsontable/styles/handsontable.min.csswith the classic theme (ht-theme-classic,themeNameoption), the closest to the previous look.--ht-cell-read-only-background-color(!important), which hid the yellow header row..table-headernow sets that variable instead ofbackground.Rows are ~3px taller with the theme; the ports still follow the column centers.
http-cache-semantics
4.3.0 is out and outside the vulnerable range;
make-fetch-happenalready allows it:yarn up -R http-cache-semantics(4.2.0 → 4.3.0).@joint/sanitizebuild and test tools (rollup ×2, serialize-javascript ×3)Its
devDependenciesmove to the versions@joint/coreand the other packages use:rollup@rollup/plugin-terserserialize-javascript6 → 7)@rollup/plugin-node-resolvemochaserialize-javascript6 → 7)Nothing a consumer installs changes: no runtime
dependencies, the@joint/corepeer range (>=4.1.0 <5),src/and the bundle configuration are untouched.Testing
vite build. (Itsbuildscript runstsc, which this JavaScript example does not install - that fails onmastertoo and is left as it is.) Compared withmasterin headless Chrome: same layout, ports, links and header colour; selecting a cell highlights the mapped port in both; no errors other than the missingfavicon.ico(on both).@joint/sanitize:dist/sanitize.js,dist/sanitize.min.jsandbuild/test/sanitize.jsare byte-identical when built with the old and the new tools.yarn test: mocha 12 passing, karma 106 / 106 (Chrome 156). Against the oldest supported core,@joint/core4.1.0 from npm: mocha 12 passing, karma 106 / 106.yarn changeset statuspasses (empty changeset for@joint/sanitize).