Repository navigation
Bump vitest and @vitest/coverage-v8 to 4.1.12; lockfile regenerated, audit clean - #23
Draft
AgenteLabs wants to merge 1 commit into
Draft
AgenteLabs wants to merge 1 commit into
AgenteLabs wants to merge 1 commit into
Conversation
…file The Dependency audit job is red on main on four advisories, all in the test toolchain: @vitest/mocker GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp (moderate, <=4.1.11) vite GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw and four more (high, 8.2.0 - 8.2.2) vitest and @vitest/coverage-v8 move one patch, to ^4.1.12, the first release whose mocker is patched; vite is a transitive dependency and the lockfile now resolves it to 8.3.5, inside vitest's own range. Lockfile regenerated with npm 10.9.8 (Corepack, as packageManager declares); `npm audit` reads 0 vulnerabilities and `npm run check` (typecheck, lint, coverage, standalone) passes. CHANGELOG and RELEASES untouched: nothing shipped changes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T2LtjRauY7RENs18aztY6V
AgenteLabs
pushed a commit
that referenced
this pull request
Oct 27, 2026
…s here Same two files as PR #23 (package.json, package-lock.json); no-ops once main carries it. The hygiene files are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T2LtjRauY7RENs18aztY6V
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The Dependency audit job is red on
mainon four advisories, all in the test toolchain and none in anything the package ships. This PR clears them:@vitest/mockervite(transitive, via vitest)How
vitestand@vitest/coverage-v8move one patch,^4.1.11→^4.1.12, the first release whose mocker is patched. Nothing else inpackage.jsonchanges (no TypeScript or ESLint major; Dependabot build(deps-dev): bump the development group across 1 directory with 8 updates #18 is not ported).viteis transitive; the regenerated lockfile resolves it to 8.3.5, inside vitest's own^6 || ^7 || ^8range.packageManagerdeclares. (npm 10.9.8's ideal-tree build trips on this manifest's optional peermongodb—Cannot read properties of null (reading 'edgesOut')— so the install that wrote the lock ran with--legacy-peer-deps; a cleannpm ciwith 10.9.8 from the committed lock then installs without it.)npm audit: 0 vulnerabilities.npm run check(typecheck, lint, coverage, standalone): passes.CHANGELOG.mdandRELEASES.mduntouched: nothing shipped changes.Generated by Claude Code