[typeagent-bot]

Automated Dependabot Alert Remediation

This PR was automatically generated by the fix-dependabot-alerts workflow.
Each fix was applied individually and build-verified before inclusion.

Summary

• Applied (14): liquidjs markdown-it @modelcontextprotocol/client compression dompurify exifreader fast-uri handlebars hono markdown-it proxy-addr shell-quote smol-toml source-map-js
• **Blocked (1):**js-yaml
• **No patch available (4):**sprintf-js, extract-zip, http-cache-semantics, sprintf-js
• Deferred (0): (none)
• Rolled back (13): brace-expansion @modelcontextprotocol/sdk @vue/server-renderer brace-expansion diff electron esbuild katex prosemirror-view qs underscore uuid xml2js
• Skipped (recent rollback, 0): (none)
• Workspaces with analysis failures: (none)
• Build: Passed
• Shell packaging: passed

The analysis also audits the lockfile directly. Its results can differ from the GitHub Dependabot REST API.

Why blocked packages could not be auto-fixed

Dependency chains

===== docs =====

══════════════════════════════════════════════════════════════════════
  Reading cached Dependabot alerts
══════════════════════════════════════════════════════════════════════
  Snapshot: /tmp/dependabot-alerts.json (61 alert(s))
  Found 13 alert(s) across 5 package(s)

══════════════════════════════════════════════════════════════════════
  Analyzing vulnerabilities
══════════════════════════════════════════════════════════════════════

  [1/5] 📦 brace-expansion (high) — ✗ 5.0.5 → need ≥5.0.12
     Fix: pnpm update brace-expansion -r
     → minimatch@10.2.4
       → maximatch@0.1.0
         → @11ty/recursive-copy@4.0.3
           … 1 more level(s) collapsed (use --show-chains=full)
  ⚠  Could not resolve shell production deps — shell packaging post-check will still validate

  [2/5] 📦 js-yaml (high) — ✗ 3.14.2, ✗ 4.1.1 → need ≥4.3.2
     ↳ used by: typeagent-docs
     Actions: (requires --auto-fix)
       [override] gray-matter@4.0.3 pins js-yaml ^3.13.1, already at latest — no update available
     Risk: ▲ high — major version bump 3.14.2 → 4.3.2, 1 parent(s) may break
     → @11ty/eleventy@3.1.2
       → typeagent-docs
     → gray-matter@4.0.3
       → @11ty/eleventy@3.1.2 (see above)

  [3/5] 📦 liquidjs (medium) — ✗ 10.27.0 → need ≥10.27.2
     Fix: pnpm update liquidjs -r
     → @11ty/eleventy@3.1.2
       → typeagent-docs

  [4/5] 📦 markdown-it (medium) — ✗ 14.2.0 → need ≥14.3.1
     Fix: pnpm update markdown-it -r
     → markdown-it-replace-link@1.2.2
       → typeagent-docs
     → @11ty/eleventy@3.1.2
       → typeagent-docs
     → markdown-it-anchor@8.6.7
       → typeagent-docs
     → typeagent-docs

  [5/5] 📦 sprintf-js ✗ no patch (medium) — installed: 1.0.3, no fix published

══════════════════════════════════════════════════════════════════════
  Resolution plan (dry run)
══════════════════════════════════════════════════════════════════════
  ✓  [dry-run] pnpm update brace-expansion -r → >=5.0.12
  ✓  [dry-run] pnpm update liquidjs -r → >=10.27.2; if still unfixed, raise pnpm.overrides["liquidjs"] from ">=10.22.0 >=10.25.5 >=10.26.0" to ">=10.22.0 >=10.25.5 >=10.26.0 >=10.27.2" + pnpm install
  ✓  [dry-run] pnpm update markdown-it -r → >=14.3.1

══════════════════════════════════════════════════════════════════════
  Summary
══════════════════════════════════════════════════════════════════════

  3 to resolve | 1 blocked | 1 no fix available

  Fixed packages:
     ✓  [update] brace-expansion 5.0.5 → >=5.0.12
     ✓  [update] liquidjs 10.27.0 → >=10.27.2
     ✓  [update] markdown-it 14.2.0 → >=14.3.1

  Risk assessment:
     ▲ high  [override] js-yaml >=4.3.2: major version bump 3.14.2 → 4.3.2, 1 parent(s) may break

  Run with --auto-fix to fix: js-yaml
    (or --apply-overrides for: js-yaml)

  ⚠  DRY RUN — no changes were made. Run without --dry-run to apply.

How this works

1. Analyses open Dependabot alerts and the lockfile
2. Applies each fix individually with build verification
3. Rolls back fixes that break the build
4. Includes only verified fixes

Review checklist

• Check for breaking changes
• Investigate rolled-back packages
• Run relevant tests