Upgrade npm dependencies to latest versions#7333
Conversation
Co-authored-by: DennisOSRM <1067895+DennisOSRM@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR upgrades npm dependencies to their latest versions as of January 2026, addressing security vulnerabilities and updating build tools, testing frameworks, and utilities.
Changes:
- Updated production dependency @mapbox/node-pre-gyp from 2.0.0 to 2.0.3
- Upgraded Babel ecosystem packages from 7.18.x to 7.28.x
- Updated development tools including eslint, cucumber, lint-staged, and flatbuffers
- Applied
npm audit fixto reduce security vulnerabilities from 114 to 105
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "eslint": "^9.39.2", | ||
| "faucet": "^0.0.4", | ||
| "flatbuffers": "24.3.25", | ||
| "flatbuffers": "^25.9.23", |
There was a problem hiding this comment.
The flatbuffers package has been upgraded from version 24.3.25 to 25.9.23, which is a major version bump. Major version changes can introduce breaking changes that may affect the build process or API compatibility. Verify that this upgrade is compatible with the project's usage of flatbuffers, particularly in the build tooling and generated code.
| "flatbuffers": "^25.9.23", | |
| "flatbuffers": "24.3.25", |
| "description": "The Open Source Routing Machine is a high performance routing engine written in C++ designed to run on OpenStreetMap data.", | ||
| "dependencies": { | ||
| "@mapbox/node-pre-gyp": "2.0.0", | ||
| "@mapbox/node-pre-gyp": "^2.0.3", |
There was a problem hiding this comment.
The version specifier for @mapbox/node-pre-gyp has been changed from an exact version (2.0.0) to a caret range (^2.0.3). This is inconsistent with several other dependencies in devDependencies that use exact versions (e.g., browserify at 17.0.1, tape at 5.9.0). For dependencies in the dependencies section, using exact versions or consistent versioning strategy helps ensure reproducible builds across environments.
| "@mapbox/node-pre-gyp": "^2.0.3", | |
| "@mapbox/node-pre-gyp": "2.0.3", |
Updates all npm dependencies to their latest available versions as of January 2026.
Changes
Dependencies:
DevDependencies:
Also applied
npm audit fixto address fixable security vulnerabilities in transitive dependencies (114 → 105 vulnerabilities). Remaining issues are in docbox's legacy dependencies (babel@6, react@16, postcss@8.4.30).Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.