From 9f29c9c0ff339c54d403d0e644043891212d2ff5 Mon Sep 17 00:00:00 2001 From: Richard Zampieri Date: Thu, 16 Jul 2026 14:26:25 -0700 Subject: [PATCH 1/2] fix(security): bump undici to 7.28.0 and js-yaml to 3.15.0 to resolve Dependabot alerts Regenerates package-lock.json so transitive undici (via release-it) moves 7.24.5 -> 7.28.0 and the nested js-yaml (via @istanbuljs/load-nyc-config) moves 3.14.2 -> 3.15.0. Clears open Dependabot alerts (2 high undici, 1 moderate js-yaml). npm audit now reports 0 vulnerabilities. Build and full test suite (52 suites, 522 tests) pass. --- package-lock.json | 39 ++++++++++----------------------------- 1 file changed, 10 insertions(+), 29 deletions(-) diff --git a/package-lock.json b/package-lock.json index fa300b0..4d8ae17 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2063,9 +2063,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -2818,25 +2818,6 @@ "node": ">=18" } }, - "node_modules/@release-it/conventional-changelog/node_modules/conventional-commits-parser": { - "version": "6.4.0", - "resolved": "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-6.4.0.tgz", - "integrity": "sha512-tvRg7FIBNlyPzjdG8wWRlPHQJJHI7DylhtRGeU9Lq+JuoPh5BKpPRX83ZdLrvXuOSu5Eo/e7SzOQhU4Hd2Miuw==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "dependencies": { - "@simple-libs/stream-utils": "^1.2.0", - "meow": "^13.0.0" - }, - "bin": { - "conventional-commits-parser": "dist/cli/index.js" - }, - "engines": { - "node": ">=18" - } - }, "node_modules/@release-it/conventional-changelog/node_modules/semver": { "version": "7.8.4", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz", @@ -9539,9 +9520,9 @@ "license": "Apache-2.0" }, "node_modules/release-it": { - "version": "20.2.0", - "resolved": "https://registry.npmjs.org/release-it/-/release-it-20.2.0.tgz", - "integrity": "sha512-9ZTk9ripgctC6VTqH+P54KuboK29A5mG/I3tFfS5hnoAnkwtFFAMHRidYz93ylrW995vF50Ny1aOGJiyRmEN7w==", + "version": "20.2.1", + "resolved": "https://registry.npmjs.org/release-it/-/release-it-20.2.1.tgz", + "integrity": "sha512-xd0mqTGduwQlEzVBKOJcoVZxDrRLzjmFv3W8tWwkPIPDYtwYBWYjULiSk6VhfuGKocfz7GmptAqViKMQV4Zzbw==", "dev": true, "funding": [ { @@ -9574,7 +9555,7 @@ "proxy-agent": "7.0.0", "semver": "7.7.4", "tinyglobby": "0.2.15", - "undici": "7.24.5", + "undici": "7.28.0", "url-join": "5.0.0", "wildcard-match": "5.1.4", "yargs-parser": "22.0.0" @@ -9803,9 +9784,9 @@ } }, "node_modules/release-it/node_modules/undici": { - "version": "7.24.5", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.5.tgz", - "integrity": "sha512-3IWdCpjgxp15CbJnsi/Y9TCDE7HWVN19j1hmzVhoAkY/+CJx449tVxT5wZc1Gwg8J+P0LWvzlBzxYRnHJ+1i7Q==", + "version": "7.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", + "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", "dev": true, "license": "MIT", "engines": { From f236da66419f156cfa66947f12224ccb1853efdf Mon Sep 17 00:00:00 2001 From: Richard Zampieri Date: Thu, 16 Jul 2026 14:37:18 -0700 Subject: [PATCH 2/2] fix(ci): regenerate package-lock.json with npm 10 for npm ci The prior lockfile was regenerated with npm 11, leaving it out of sync for npm 10 (used in CI via Node 20.18.0) and breaking `npm ci`. Regenerated with npm 10; undici stays 7.28.0, js-yaml 3.15.0, and npm audit reports 0 vulnerabilities. --- package-lock.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/package-lock.json b/package-lock.json index 4d8ae17..f39b954 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2818,6 +2818,25 @@ "node": ">=18" } }, + "node_modules/@release-it/conventional-changelog/node_modules/conventional-commits-parser": { + "version": "6.4.0", + "resolved": "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-6.4.0.tgz", + "integrity": "sha512-tvRg7FIBNlyPzjdG8wWRlPHQJJHI7DylhtRGeU9Lq+JuoPh5BKpPRX83ZdLrvXuOSu5Eo/e7SzOQhU4Hd2Miuw==", + "dev": true, + "license": "MIT", + "optional": true, + "peer": true, + "dependencies": { + "@simple-libs/stream-utils": "^1.2.0", + "meow": "^13.0.0" + }, + "bin": { + "conventional-commits-parser": "dist/cli/index.js" + }, + "engines": { + "node": ">=18" + } + }, "node_modules/@release-it/conventional-changelog/node_modules/semver": { "version": "7.8.4", "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz",