Repository navigation
security(deps): bump vitest/undici/zod to clear new HIGH advisories (unblocks ci) - #47
Merged
Merged
Conversation
… new advisories The blocking `npm audit --audit-level=high` step in `ci` began failing on main for every PR once these advisories were published: - undici <=6.29.0 (HIGH): GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, GHSA-9fm3-97px-rjf6 (transitive via @ai-sdk/provider-utils ^6.28.0) -> 6.29.1 - zod <4.6.6 (HIGH): GHSA-mrhx-c7xc-m3w5 (peer of ai / @ai-sdk/*) -> 4.6.7 - @vitest/mocker <=4.1.11 (moderate): GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp -> vitest/@vitest/* 4.1.12 (devDependency floor raised to ^4.1.12) All bumps are within existing semver ranges; no override added. npm audit reports 0 vulnerabilities. typecheck, vitest (128 tests, unchanged), build + verify:bundle, content-lint --strict and sbom all pass locally. Lockfile regenerated with npm 11 because npm 10.9.4 hits an arborist peer-set crash ("reading 'edgesOut'") resolving vitest 4.1.12; `npm ci` under npm 10 installs the result cleanly. Signed-off-by: Larry Klosowski <larryklosowski@proton.me> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FPJzHN7kVR6UzVEJDEY9Yc
BerryManifold
left a comment
BerryManifold
left a comment
Contributor
There was a problem hiding this comment.
Automated Codex static review of b291e6ae59155e0a901e5f958d2619f6d4ec8f85 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.
Matr0xshka
reviewed
Nov 8, 2026
Matr0xshka
left a comment
Matr0xshka
left a comment
There was a problem hiding this comment.
Automated Codex static review of b291e6ae59155e0a901e5f958d2619f6d4ec8f85 is complete. Result: clean; details retained privately. Details and coverage limits are recorded in the project's private review log. No tests were executed by this reviewer. Both account submissions represent the same Codex review, not independent reviews.
SaulBuilds
added a commit
that referenced
this pull request
Nov 8, 2026
Brings the vitest 4.1.12 / undici 6.29.1 / zod 4.6.7 lockfile bump so the blocking npm audit step passes on this PR. The same commit (b291e6a) is what #47 lands on main, so merging main later is a no-op for these files. Signed-off-by: Larry Klosowski <larryklosowski@proton.me> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FPJzHN7kVR6UzVEJDEY9Yc
Matr0xshka
approved these changes
Nov 8, 2026
Matr0xshka
left a comment
Matr0xshka
left a comment
There was a problem hiding this comment.
MAC independent reviewer agent, not Codex, not DGX, not a human reviewer.
Reviewed head b291e6a. No P1, no P2.
- Lockfile diffed per package against main b2ec378. Only undici 6.28.1→6.29.1, zod 4.4.3→4.6.7 and vitest 4.1.11→4.1.12 moved, plus patch/minor transitive deps. No adds or removes, no majors; every resolved URL is on registry.npmjs.org.
- Commands: npm ci OK; npm audit 0 vulnerabilities; typecheck pass; npm test 124 passed + 4 skipped (128, same as main); content-lint --strict OK. CI 10/10 green.
- P3: npm 11 libc metadata on 4 lightningcss entries (harmless).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ci/buildfails at Dependency audit (block HIGH) on main and on every open PR (seen on #46, job 128597869453) since these advisories were published:@ai-sdk/provider-utils^6.28.0)ai/@ai-sdk/*)What
package.json: devDependencyvitestfloor^4.1.11->^4.1.12.package-lock.json: regenerated. undici, zod, and vitest with its@vitest/*/ rolldown / lightningcss chain move within their existing ranges. No new overrides.Verification (local, Node 22.21.1, clean
npm ciunder npm 10.9.4)npm audit-> found 0 vulnerabilitiesnpm run typecheck-> passnpm test-> 124 passed, 4 skipped (128, same count as main)npm run build(prebuild content + postbuild verify:bundle) -> passnpm run content-lint -- --strict-> OKnpm run sbom-> passscripts/local_ci.py .wt-ciFix-docs-> everyci.yml:buildstep green. The red rows are environment-only:chain-syncneeds a.chain-srccheckout, and themerge-gatesteps need Actions env vars.Notes:
Cannot read properties of null (reading 'edgesOut')) when it resolves vitest 4.1.12's peer set.npm ciunder npm 10 installs the result cleanly, and that is what CI runs.--no-verify. The installed pre-push hook runslocal_ci.py citrate-docs, which checks the primary checkout rather than the worktree being pushed. It would therefore audit main's old lockfile, not this branch. The worktree run above is the real local gate.Once this merges, #46 needs main merged in.
🤖 Generated with Claude Code