Repository navigation
fix: resolve remaining dependency audit findings - #3
Conversation
|
Capy couldn't review this pull request because h1's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews. |
|
Warning Review limit reachedNext included review available in 42 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
nonnil
left a comment
nonnil
left a comment
There was a problem hiding this comment.
Reviewed commit e172289 against main. No actionable issue found in the bounded dependency update.
- Manifest minimums and lockfile resolutions agree: Hono 4.13.5, Vitest and its seven companion packages 4.1.11. Gateway and Safe Relay share the patched Hono instance.
- No unrelated package versions, application code, overrides, toolchain settings or CI thresholds changed. npm filled missing registry integrity metadata for existing Vitest dependencies. The js-yaml 4.3.2 fix remains.
- A clean install, full audit (zero findings at every severity), dependency-tree check and release verification passed locally. All 162 tests passed. GitHub CI also passed on this commit: https://github.com/hauntedfail/Doge/actions/runs/36334273468.
Automated review is unavailable for this PR: CodeRabbit reports its included review limit and Capy reports insufficient workspace credits. CodeRabbit's successful status is not evidence of a completed review. This PR is therefore left open for review. This comment is not an independent approval: the authenticated account is also the PR author.
No production deployment was performed.
nonnil
left a comment
nonnil
left a comment
There was a problem hiding this comment.
Self-review complete for e172289. The current diff exactly matches the verified content; no actionable findings or new review comments remain. Full npm audit reports zero vulnerabilities, all 162 tests and release verification pass, and GitHub CI is successful. The user has explicitly authorised self-review as the merge decision, so this supersedes the earlier decision to wait for an external review. Proceeding with the normal merge. Automated reviewers did not perform a review due to their service limits.
1 participant
The installed dependency graph reported three Moderate npm audit entries across Hono and Vitest/@vitest/mocker. Raise the supported minimums to Hono 4.13.5 and Vitest 4.1.11 and update their lockfile resolutions to remove the affected versions.
The Hono update addresses three advisories; Vitest and @vitest/mocker share one advisory. The existing js-yaml 4.3.2 fix and dependency overrides are retained. CI commands and audit thresholds are unchanged.
Upstream fixes:
Validation on Node 24.15.0 and npm 11.12.1:
npm ciand fullnpm audit --jsonpassed: zero findings at every severity.npm ls hono vitest @vitest/mocker js-yamlconfirmed one shared Hono 4.13.5, aligned Vitest/mocker 4.1.11 and js-yaml 4.3.2.npm run cipassed: formatting, repository checks, TypeScript, 33 test files / 162 tests, all builds, production packaging and artefact security checks.git diff --checkpassed.Package SHA-256:
1423b8d7f6450b84340a1cacff0a23aaded16a26e57a5a057e349cc1bbb900b9. The generated package is excluded from Git. No production deployment or physical-device validation was performed.