Repository navigation
chore: clear npm audit advisories in the dev dependency tree - #17
Merged
Merged
Conversation
`npm audit fix` resolves 23 of the 24 advisories accumulated since the last release (vite, shell-quote, qs, fast-uri, launch-editor, etc. — all transitive devDependencies; nothing shipped changes). The remaining low-severity advisory (GHSA-g7r4-m6w7-qqqr, esbuild 0.27.3–0.28.0 dev-server file read on Windows) has no in-range fix via tsx/vite yet, so it gets an .nsprc exception with removal notes — esbuild is only used here as a build/test transform, never as a dev server. The stale uuid exception (fixed by the update) is removed. Unblocks CI for #15 and #16, which fail on the audit step for advisories predating those branches. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Aug 15, 2026
mderriey
approved these changes
Aug 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CI's audit step (
better-npm-audit) fails onmainwith 24 advisories accumulated in the devDependency tree since the last release (vite, shell-quote, qs, fast-uri, launch-editor, …). This blocks every PR — #15 and #16 are stacked on top of this fix.Fix
npm audit fix(lockfile-only, within existing semver ranges) resolves 23 of 24. Nopackage.jsonranges change and nothing shipped to consumers changes..nsprcexception with notes, following the repo's existing pattern — esbuild is used here only as a build/test transform, never as a dev server.better-npm-auditreports it no longer matches anything after the update).Testing
npm run audit("All good!"),npm run build(lint, check-types, rollup, attw all green), andnpm testpass locally.🤖 Generated with Claude Code