Repository navigation
chore: bump three dev deps to clear high-severity advisories - #77
Merged
Merged
Conversation
The security job (npm audit --audit-level=high) has been failing on every open PR. All three advisories are devDependency-only, so no published @xyte/cli consumer is affected: brace-expansion 5.0.8 -> 5.0.9 GHSA-rgw5-rvv9-x895 fast-uri 3.1.4 -> 3.1.7 GHSA-7p8r-x3mc-p8w7 nanoid 3.3.16 -> 3.3.18 GHSA-2v37-7h3g-55p8 Lockfile only; package.json and all runtime dependencies are untouched. npm audit --audit-level=high now exits 0.
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
borisd
added
the
awaiting-reviewer
ariel-greenfeld
left a comment
ariel-greenfeld
left a comment
Contributor
There was a problem hiding this comment.
from claude:
Reviewed the lockfile diff. The three bumps are clean on every structural check (range satisfaction, prod/dev flag correctness, orphans, registry integrity/tarball/dependency verification all match). One finding inline: the brace-expansion pin has gone stale since this branch was pushed.
added 2 commits
October 2, 2026 13:59
Review fix for 4142558219: 5.0.9 no longer clears the brace-expansion advisories published 2026-09-29 (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr); fast-uri 3.1.8 clears GHSA-hrr3-gc8f-f4qj.
Contributor
Author
|
AI: @ariel-greenfeld Plz review - this is to deploy new docs Julie built for CLI |
…visories New advisories published since the first bump (source-map-js GHSA-68fv-2mgg-jv7q is high) turned the security job red again. Lockfile-only, semver-compatible.
ariel-greenfeld
approved these changes
Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
securityjob (npm audit --audit-level=high) has been failing on every open PR in this repo (#72, #73, #74, #75, #76 …), so a real advisory would currently be indistinguishable from the standing noise.All of these advisories are devDependency-only. They arrive through eslint/glob, ajv and vitest/vite.
@xyte/cliships only its eight runtime deps, so no consumer of the published package is affected. The blast radius is the dev/CI toolchain.package.jsonis untouched and no runtime dependency changes. The lockfile was produced withnpm update brace-expansion fast-uri nanoid --package-lock-onlyrather than a barenpm audit fix.npm audit fixwanted to bump 48 packages (vitest 4.1.4→4.1.11, vite 8.0.16→8.2.2, rolldown, lightningcss, postcss), which is a toolchain upgrade that deserves its own PR.npm audit --audit-level=highnow exits 0.Residual: two moderate advisories remain:
@vitest/mockerpath traversal (GHSA-82fw-gwwq-j7x9) and@humanfs/nodesymlink copy (GHSA-p498-v437-472g). They don't fail the gate at--audit-level=high. Clearing them is the vitest/vite bump mentioned above.