fix(ci): resolve npm audit findings - #23
Merged
Merged
Conversation
The Repository gates job runs npm audit and currently fails on every recent main build: - js-yaml 3.15.0 / 4.3.0: quadratic CPU consumption in !!omap resolution (CVE-2026-59870) - nanoid 3.3.16: custom generators can loop indefinitely when size is zero npm audit fix upgrades the transitive lockfile entries to js-yaml 3.15.1/4.3.1 and nanoid 3.3.18. Build and package tests still pass.
erwinmsmith
added a commit
that referenced
this pull request
Aug 14, 2026
The published 1.0.0 line predates two fixes now on main: - #22 ships the framework built-in skills inside @codesoul-co/hypha-skills (tarball data + resolveBuiltinSkillsDirectory export); - #23 resolves the npm audit findings that fail the Repository gates job. The patch release moves the whole release line to 1.0.1 with exact-version internal dependencies.
erwinmsmith
added a commit
to erwinmsmith/THETA-Agent
that referenced
this pull request
Aug 14, 2026
Hypha is no longer a local third_party checkout. THETA-Agent now depends on the published @codesoul-co/hypha-* npm release line (1.0.1) exactly as Hypha's official release guidance prescribes; THETA remains the single third_party upstream checkout. - manifests: replace all file:third_party/Hypha dependencies with @codesoul-co/hypha-*@1.0.1 and drop the hypha:install/hypha:build steps - imports: rename every @hypha/* import across agent, tools, domain to the published package names - skills: load Hypha built-in skills from the shipped resolveBuiltinSkillsDirectory() data of @codesoul-co/hypha-skills instead of a source checkout - doctor: replace hypha.lock/hypha.build checks with hypha.packages, which verifies the installed release line, package entries, and shipped built-ins - upstreams: config/upstreams.lock.json now pins only THETA - tooling: allow better-sqlite3 postinstall for pnpm; update repository validation, README, architecture and CLI docs accordingly Hypha-side fixes released upstream and consumed here: - CodeSoul-co/Hypha#22 ships built-in skills in the hypha-skills tarball - CodeSoul-co/Hypha#23 resolves the npm audit failures - CodeSoul-co/Hypha#24 prepares and publishes @codesoul-co/hypha-* 1.0.1 - CodeSoul-co/Hypha#25 makes the official consumer example compile from the registry Verified: build, test:registries, test:providers, test:docs, test:python, validate, doctor, governed demo, REPL, and the HTTP API all pass without a Hypha checkout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
Repository gatesCI job runsnpm auditand has been failing on every recent main build with 2 high-severity findings:js-yaml3.15.0 / 4.3.0 — quadratic CPU consumption in!!omapresolution (CVE-2026-59870)nanoid3.3.16 — custom generators can loop indefinitely when size is zeroChange
npm audit fixbumps only the lockfile entries:No package.json ranges changed.
Verification
npm audit→ 0 vulnerabilities ✅npm run build:packages✅npx vitest run packages/skills/src/skills.test.ts(12 tests) ✅