fix(deps): resolve open Dependabot alerts - #734
Merged
Conversation
Alerts #53 and #54 flag fast-uri below 3.1.6, both high severity. Commit 902873c already bumped fast-uri to 3.1.6 in package.json and pnpm-lock.yaml. This commit regenerates the pinned analyst-benchmark dependency-lock digest with `pnpm analyst:pin`. The digest pins pnpm-lock.yaml content and went stale after the bump, failing `pnpm run verify:package`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves both open Dependabot alerts (SOC 2 Vanta Request 7).
Both alerts are the same transitive dependency (via
ajv), pinned through the existingpnpm.overridesentry inpackage.json. Bumping the override to3.1.6(the first patched version for both advisories) resolves both.pnpm-lock.yamlnow resolves a singlefast-uri@3.1.6everywhere (verified via grep — no other versions present).Bumping
pnpm-lock.yamlinvalidated the pinned dependency-lock digest thatpnpm run verify:packagechecks (src/analyst/benchmark-implementation.ts, regenerated viapnpm analyst:pin). That's the only other file this PR touches.No other manifest is affected:
clients/python/pyproject.toml/uv.lockhave no open alerts.Gate results (run locally,
NODE_OPTIONS=--no-network-family-autoselectionfor this host's IPv6-less network)pnpm install --frozen-lockfilepnpm buildpnpm typecheckpnpm typecheck:examplespnpm typecheck:scriptspnpm lint(biome)pnpm run check:model-idspnpm run contract:finding:checkpnpm run verify:packagepnpm analyst:pin)pnpm testuv sync --frozen --extra dev(inclients/python)uv run --frozen --extra dev pytest -v(base extras only)ModuleNotFoundError: skillopt/gepa, from optionalskillopt-source/gepa-sourcegroups not installed in this scoped run; unrelated to this diffpnpm testfailures are pre-existing, not caused by this changeVerified by cloning the pre-WIP commit (
3c11a598, i.e.mainbefore this branch) into a clean worktree and running the same suite: identical 39 failures, same files, same counts. Root cause for the largest cluster (tests/campaign/worktree.test.ts, 27/29 failing) is macOS-specific:/tmpresolves through a symlink (/private/tmp) on this host, which trips the suite's symlink-escape detection insrc/campaign/worktree/index.ts. CI (.github/workflows/ci.yml) runs onubuntu-latest, where/tmpis not a symlink, so this cluster is not expected to reproduce there. The remaining 11 failures (src/analyst/benchmark-command*.test.ts,benchmark-implementation.test.ts,benchmark-verification-artifacts.test.ts,external-optimizer-process.test.ts) reproduce identically on baseline and are unrelated to the dependency bump.No tests were modified, skipped, or weakened to reach this result.
Alerts left
None — both open alerts addressed.