From 1deaf2f716d360dbe80c6427b2f103129cf44faf Mon Sep 17 00:00:00 2001 From: Forketyfork Date: Sun, 24 May 2026 19:40:57 +0200 Subject: [PATCH] chore(deps): pin obsidian to ^1.12.3 instead of "latest" The "latest" dist-tag confuses dependabot's advisory matcher, which flags a false-positive CVE-2021-38148 alert (the obsidian < 0.12.12 vuln) for every install. Pinning to a concrete semver range resolves the spec unambiguously and lets dependabot continue to roll the typings forward under the 7-day cooldown. --- package.json | 2 +- pnpm-lock.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index f5943c8..01425d9 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "globals": "^17.6.0", "jest": "^30.4.2", "jest-environment-jsdom": "^30.4.1", - "obsidian": "latest", + "obsidian": "^1.12.3", "prettier": "^3.8.3", "stylelint": "^17.11.1", "stylelint-config-standard": "^40.0.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a43830f..659fef2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -56,7 +56,7 @@ importers: specifier: ^30.4.1 version: 30.4.1 obsidian: - specifier: latest + specifier: ^1.12.3 version: 1.12.3(@codemirror/state@6.6.0)(@codemirror/view@6.43.0) prettier: specifier: ^3.8.3