- TypeScript 74.7%
- MDX 13.8%
- SCSS 6.3%
- JavaScript 4.2%
- CSS 0.8%
- Other 0.2%
9d9bf5f7b2# Describe the pull request ## Links - [Dependabot alerts](https://github.com/Amsterdam/design-system/security/dependabot) - [GHSA-23hp-3jrh-7fpw](https://github.com/advisories/GHSA-23hp-3jrh-7fpw), the critical node-tar advisory that prompted this - [rollup-plugin-filesize on npm](https://www.npmjs.com/package/rollup-plugin-filesize), last published in February 2023 ## What Three separate commits. The first runs `pnpm run update:minor`, which moves fifteen packages including ESLint, typescript-eslint, Storybook, Prettier, Stylelint, Vite, PostCSS and SVGO. The second clears every open Dependabot alert. The third removes `rollup-plugin-filesize`, which takes 198 packages out of the lockfile. ## Why Dependabot listed eight open alerts: four for node-tar, three for brace-expansion and one for js-yaml. The most recent is rated critical. None of them were reachable in practice. All eight sit in development dependencies, and the four node-tar ones entered through a code path that our configuration never executes, so nothing that ships to consumers was ever affected. They are worth clearing regardless, since the fix is small and leaving known-vulnerable versions in the lockfile makes it harder to notice an alert that does matter. Two of the overrides already existed but had quietly gone stale: both `js-yaml` and `tar` were pinned to versions that newer advisories have since come to cover. They were fixes that expired without anyone noticing. The third commit addresses the cause rather than the symptom. Every node-tar alert reached us through `rollup-plugin-filesize`, which pulls in the npm registry client stack — `pacote`, `node-gyp`, `cacache` and `tar` — to support a feature we do not use. Bumping `tar` would have left that chain in place to produce the same alerts again. ## How For the security commit, the overrides in `pnpm-workspace.yaml` were updated to versions that satisfy every advisory. `brace-expansion` is vulnerable across three major lines at once, so it gets one entry per line. Raising every consumer to 5.x instead would have handed `minimatch` 3 an API it does not expect. `npm-check-updates` rewrites the `packageManager` field without its integrity hash. The pinned `+sha512.…` form is restored, using a hash derived as the hex-encoded SHA-512 of the published tarball. That derivation was validated against the existing pin for the previous version first, where it reproduced the committed hash exactly. For the removal, alternatives were measured before deciding to drop it outright. `rollup-plugin-summary` costs 79 packages and ships ESLint config packages as runtime dependencies; `rollup-plugin-visualizer` costs 28 but produces a treemap rather than a console summary; `rollup-plugin-bundle-size` costs 15 but was abandoned in 2022. None is a good trade. No replacement was added, because the Check bundle size workflow has reported the same numbers on every pull request since April 2026, built from both the base branch and the pull request so the figures come with a baseline to compare against. Nothing reads the plugin's console output. It also reported a minified size for a bundle that is never minified, since the build has no terser step and consumers minify the package themselves. ## Checklist - [x] Add or update unit tests - [x] Add or update documentation - [x] Add or update stories - [x] Add or update exports in index.\* files - [x] Comment `/chromatic test` and verify visual regression tests pass - [x] Start the PR title with a Conventional Commit prefix, [as explained here](https://github.com/Amsterdam/design-system/blob/main/documentation/publishing.md?plain=1#L11). ## Additional notes Build output is unchanged by the removal, verified by comparing checksums of every build artefact before and after. The `tar` override is now technically redundant, as nothing pulls `tar` any more. It is kept deliberately: an inert override costs nothing and guards against the chain returning through a future dependency. Worth a reviewer's attention: `pnpm run update:minor` also bumps pnpm itself, from 11.11.0 to 11.15.1. That is a toolchain change riding along with the dependency update rather than a deliberate decision, so it is easy to drop if you would rather it landed separately. Separately, the `minimumReleaseAgeExclude` list in `pnpm-workspace.yaml` appears to be dead configuration. The setting it belongs to is not configured anywhere, and most of the versions it pins no longer exist in the tree. It is left untouched here and is worth a look on its own. |
||
|---|---|---|
| .github | ||
| .husky | ||
| documentation | ||
| packages | ||
| packages-proprietary | ||
| plop-templates | ||
| storybook | ||
| stylelint | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .nano-staged.json | ||
| .npmpackagejsonlintrc.json | ||
| .nvmrc | ||
| .prettierignore | ||
| .prettierrc.json | ||
| .release-please-manifest.json | ||
| .stylelintignore | ||
| .stylelintrc.json | ||
| AGENTS.md | ||
| CONTRIBUTING.md | ||
| eslint.config.mjs | ||
| eslint.rules.mjs | ||
| LICENSE.md | ||
| LICENSE.txt | ||
| NOTICE.md | ||
| package.json | ||
| plopfile.mjs | ||
| pnpm-lock.yaml | ||
| pnpm-workspace.yaml | ||
| publiccode.yml | ||
| README.md | ||
| release-please-config.json | ||
| tsconfig.json | ||
Amsterdam Design System
This is the guide for the user interfaces of all digital products and services provided by the City of Amsterdam.
We offer reusable components, patterns and guides for teams that work on our websites. This helps everyone work faster and better, with more time to create value. To our citizens and businesses, all our channels look the same and work similarly; they are broadly accessible and evoke trust.
We aim to create libraries for, or support otherwise, Figma, CSS, React, React Native, and Mendix.
Related resources
A Storybook portal demonstrates our components and documentation.
Our Figma Library contains the design of our components and patterns.
Getting started
See the getting started documentation for developers on how to use our React components.
AI assistance
If you build with an AI coding assistant, connect it to our Model Context Protocol (MCP) server. Your assistant then works with real Amsterdam Design System components and their correct properties, instead of inventing markup. See connecting AI assistants to set it up.
Contributing
See the documentation for contributors.
Code of conduct
We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. Read our Code of Conduct if you haven’t already.
NL Design System
This project is part of a community initiative to use NL Design System components for websites that comply with the Amsterdam Design System.
Join the #nl-design-system Slack via praatmee.codefor.nl for more information and to learn about things happening in our open-source community.
Thanks
Thanks to Chromatic for providing the visual testing platform that helps us review UI changes and catch visual regressions.
Licence
This project is free and open-source software licenced under the European Union Public License (EUPL) v1.2 or higher.
Documentation is licenced as Creative Commons Zero 1.0 Universal (CC0-1.0).
The open-source licences do not cover the assets in the packages-proprietary directory.
Each directory in the packages-proprietary directory specifies the applicable licence for that directory.
Please read the notice for more information about proprietary assets.