From 935bfcf16e5a2d89a98e633a6f6cc190aab3c50f Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 6 Oct 2026 10:38:30 +0000 Subject: [PATCH 1/2] ci: audit production dependencies in the runtime audit step The step is named for runtime dependencies but was auditing the full tree. Pass --omit=dev and keep --audit-level=moderate so dev-only advisories drop out and production advisories still fail the build. Co-authored-by: John Osumi --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8ffa128..bcd061b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,7 @@ jobs: - name: Lint Markdown run: npm run lint:markdown - name: Audit runtime dependencies - run: npm audit --audit-level=moderate + run: npm audit --omit=dev --audit-level=moderate - name: Inspect package contents run: npm pack --dry-run From 2519bc99e2f894cccd779b7f9bef32c4798c574e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 6 Oct 2026 10:42:35 +0000 Subject: [PATCH 2/2] build(deps): bump axios from 1.18.1 to 1.20.0 Regenerate the lockfile with npm update axios so the production tree matches Dependabot #46. No other locked versions change. Co-authored-by: John Osumi --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 4989a54..3124cdc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -256,13 +256,13 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.18.1", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz", - "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==", + "version": "1.20.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz", + "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==", "license": "MIT", "dependencies": { "follow-redirects": "^1.16.0", - "form-data": "^4.0.5", + "form-data": "^4.0.6", "https-proxy-agent": "^5.0.1", "proxy-from-env": "^2.1.0" }