Repository navigation
chore(deps): npm audit fix — 29 → 7 advisories, vitest held on 4.0.x for Node 18 - #59
Merged
Merged
Conversation
`npm audit fix` (no --force) on the root lockfile. package.json is unchanged; only resolved versions within existing ranges move, e.g. hono 4.12.0 -> 4.13.8 (via @modelcontextprotocol/sdk) and vitest 4.0.18 -> 4.1.11. Supersedes dependabot #19 (closed). Remaining 5 need a major bump: @testcontainers/postgresql chain (dev only, incl. undici) and uuid 9 -> 14 (advisory is v3/v5/v6 with buf; gitmem uses only v4). apps/docs is untouched: a change there triggers the docs deploy. Customers are unaffected either way: npm never publishes the lockfile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e 18 npm audit fix moved vitest to 4.1.11, which brings vite 8 / rolldown; rolldown imports util.styleText, absent on Node 18, so the Node 18 CI job failed at vitest startup. gitmem still declares node >=18 and CI tests 18, so vitest stays on 4.0.18 (vite now 7.3.6, which clears vite's advisories). Accepted for now: vitest's critical advisory (UI server file read/exec) and @vitest/mocker's moderate one, both dev-only. Dropping Node 18 is a separate decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nTEG-dev
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm audit fix: lockfile refresh, 29 advisories down to 7, Node 18 kept
Supersedes dependabot #19, closed because it conflicted with main and its hono target was still vulnerable.
npm audit fix --legacy-peer-depson the root, without--force.~4.0.18inpackage.json. The audit fix had moved it to 4.1.11, which pulls in vite 8 / rolldown. rolldown importsutil.styleText, which Node 18 lacks, so the Node 18 CI job failed at vitest startup. gitmem still declaresnode >=18and CI tests 18, so vitest stays on the 4.0 line. Dropping Node 18 is a separate decision.Every other version moves only within its existing range. Examples: hono 4.12.0 → 4.13.8 (through
@modelcontextprotocol/sdk), vite 7.3.1 → 7.3.6.Customers are unaffected either way: npm never publishes the lockfile, and the only
package.jsonchange is a devDependency range.Advisories
Remaining, all accepted for now:
vitest(critical) and@vitest/mocker(moderate): fixed only in vitest ≥ 4.1.11, which needs Node ≥ 20. The critical one applies only while the Vitest UI server is running. Dev-only.@testcontainers/postgresql→testcontainers→dockerode/undici(high): dev-only, used by the Docker-based e2e suites; needs a major upgrade.uuid9 → 14 (moderate): the advisory covers v3/v5/v6 with abufargument. gitmem imports onlyv4, so it does not apply.apps/docs/package-lock.jsonis deliberately untouched. Any change underapps/docs/triggers the docs deploy workflow on merge.Evidence (local, Node 22, after
npm installfrom the new lockfile)There is no Node 18 locally, so CI's Node 18 build is the check for that. A full manual CI run with the venue gate covers this branch.
🤖 Generated with Claude Code