[zoeyrose]

Summary

Update the compatible npm 11 bundle to remove the remaining bundled
postcss-selector-parser finding, and give the full content validation job
enough time to finish checkout, validation, and cleanup.

Implementation / behavior

• Refresh npm 11.21.0 to 11.21.1 through the existing semantic-release
  dependency ranges. The lock retains all 454 entries; only 11 existing entries
  inside npm's subtree change. The bundled parser advances from 7.1.4 to 7.1.6.
• Raise the content job timeout from 10 to 20 minutes while preserving every
  validation step. The merged-main run completed its validation and clean-source
  steps but received the explicit ten-minute timeout annotation during finalization.
• Document the remaining bundled dependency findings. Keep the two previously
  fixed non-bundled Undici copies and the Git 2.56 history fix unchanged.

Validation

Using the pinned Linux build image with Node 24.18.1, npm 11.16.0, Git 2.56.0,
and local Python 3.14.4 (the required remote workflow checks Python 3.13):

• npm ci --ignore-scripts --no-audit --no-fund passed without changing the lock.
• Verified all 453 installed dependency versions against the lockfile.
• Both release-policy and release-safety test scripts passed.
• actionlint .github/workflows/check.yml passed.
• python3 tools/validate.py passed: 187 tests, all corpus/catalog/schema and
  provenance checks, and isolated runtime collection.
• git diff --check passed.

Limitations / follow-up

This is a partial dependency remediation. npm 11.21.1 still bundles Undici 6.29.0
and minimatch 10.2.5, which remain affected by
Undici advisories and
the minimatch advisory.
The inspected npm 12.2.1 bundle has the same affected versions and falls outside
the current parent range. No npm major override, minimatch override, vendored
bundle patch, authored-content change, or validator weakening is included.

Track a compatible upstream npm bundle containing Undici 6.29.1 or later and
minimatch 11.0.1 or later. Remaining risk is not accepted or hidden by this change.

[zoeyrose]

Self-review

Fresh-context independent review inspected the complete three-file diff from
097084b974b592d84f9adaa79e6755eedfa2c04a through
666fd22c0c9bae816732de88391ab629e6661bcb, along with the release/validation
workflows, affected configuration, tests, provenance, advisory evidence and
the original ten-minute timeout annotation. No actionable P0–P3 findings were
identified, so there are no finding dispositions or fix commits to report.

The reviewer independently recomputed the 454-entry lock comparison: exactly
11 existing entries change inside npm's subtree, with no additions, removals
or changes outside that subtree. All 143 bundled package manifests match the
lock after the update. The npm tarball integrity and all 453 installed package
versions were verified. The existing non-bundled Undici fixes and M1 history
repair remain unchanged. The longer timeout preserves every validation step.

Local validation passed in the pinned credential-free 2 CPU/4 GiB build worker:
Node 24.18.1, npm 11.16.0, Git 2.56.0 and Python 3.14.4; npm ci with unchanged
lock; release-policy and release-safety checks; actionlint; the aggregate
validator with 187 tests, all corpus/provenance gates and runtime collection;
and git diff --check. Required current-head CI must separately pass with its
configured Python 3.13 before readiness.

This review covers a partial remediation only. Bundled Undici 6.29.0 and
minimatch 10.2.5 remain affected by their documented advisories. This receipt
does not accept those residual risks or claim that a compatible fixed parent
release exists. No npm major override, vendored patch, deployment or merge is
part of this change.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 2 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

package-lock.json

Name	Version	Vulnerability	Severity
undici	6.29.0	undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	high
		undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation	high
		undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent	high
		undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	moderate
		undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering	moderate
ip-address	10.7.2	ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process	moderate

Scanned Files

• package-lock.json