Repository navigation
Conversation
Runs weekly (and on demand) in client-vscode, applies in-range fixes via npm audit fix, verifies install and compile, and opens a PR for vulnerabilities Dependabot did not update. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Fail on invalid or errored npm audit reports instead of skipping - Guard jq against missing data; fall back to 'via' for transitive entries - Open a PR only when the vulnerability count drops - Split into a read-only audit/verify job and a PR job that runs no project code; no persisted checkout credentials - Create the PR with AUDIT_FIX_TOKEN so build.yml runs on it - Surface npm audit fix errors, queue runs instead of cancelling, fence audit output in the step summary Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aneshlya
force-pushed
the
automation/npm-audit-fix
branch
from
October 7, 2026 21:29
10d22be to
1a647c5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated
npm audit fixfor vulnerable dependencies that Dependabot did not update.Fixed
qs(moderate): qs array-limit bypass via bracket-key comma parsing; qs: Denial of Service via Attacker Controlled isBufferStill vulnerable (needs a major bump or
overrides)None
Changes