fix(deps): resolve all 16 open Dependabot alerts — triaged bumps, overrides where unavoidable - #980
Merged
Merged
Conversation
…own-it/@babel/core/esbuild - eslint-plugin-boundaries ^5.0.0 → ^6.0.2 in preset-react-spa: pulls handlebars 4.7.9 (direct dep of boundaries 6.x) + @boundaries/elements 2.0.1 (alerts 17-24, incl. critical CVE-2026-33937); boundaries 6.x keeps the legacy element-types rule + boundaries/elements settings working, so the shipped eslint.config.react.mjs template is unchanged. ^6.0.2 chosen over the also-available ^7.0.2 as the smaller major jump that already pins the patched handlebars 4.7.9 — same security outcome, less behavioral surface for preset consumers. - overrides qs ^6.15.2 (alerts 4, 5; both root + packages/core locks): unavoidable — latest typed-rest-client still pins vulnerable qs 6.15.1; concrete lock version resolved to 6.15.2 - overrides js-yaml 4.2.0 + markdown-it ^14.2.0 (alerts 27, 12; root lock): parent markdownlint-cli2 pins exact vulnerable versions; its 0.23.0 requires node>=22 vs CI node 20 - @babel/core → 7.29.7 (alerts 10, 13; both locks), esbuild → 0.28.1 in packages/core (alert 7) - synth bundle NOT regenerated: it is built by root esbuild (already 0.28.1, unchanged); the packages/core esbuild bump is a transitive that does not affect the bundle; build-synth-bundle.sh --check verified green (all bundle inputs byte-identical to staging) No new dependencies — overrides entries and in-range bumps only; not a capability commit. Prior-art: skipped — no new capability: npm overrides entries + in-range transitive bumps only (security lockfile maintenance); hook false-positives overrides keys as new explicit deps
…, 28, CVE-2026-39356) Static test fixtures only (detector + research tier1); consuming tests are name-based and version-insensitive — stub node_modules version bumped in lockstep so the fixture stays internally coherent.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
artyhoo
added a commit
that referenced
this pull request
Jul 11, 2026
…rides keys as new deps (#983) Follow-up invited by the maintainer after PR #980: the pre-push capability-commit gate false-positived npm `overrides` entries as new explicit dependencies and demanded a `Prior-art:` trailer on a pure security-maintenance commit. ## Change - `packages/core/hooks/checks/prior-art.ts:76-118` — `isNewDepAdded()` now tracks `overrides` / `resolutions` / `pnpm` blocks in the package.json diff (indent-based, resets at `@@` hunk headers) and skips keys inside them: they force versions of packages already in the tree, adding no capability. Documented accepted residual: a hunk editing deep inside an existing overrides block without its opening line in diff context can still false-positive — the existing escape-hatch trailer covers that rare case. - `packages/core/hooks/checks/prior-art.test.ts` — 6 new cases: 3 skip cases (overrides, resolutions, pnpm.overrides) + 3 paired negatives (new dep after the block closes → still detected; nested braces inside overrides don't end the skip early; `@@` reset → conservative re-arm). RED observed before the fix (4 failed), 104/104 after. - `CLAUDE.md:38` — prose definition updated in the same commit, per its own "the prose definition and the hook stay in sync" contract (CLAUDE.md:36). Incident evidence: PR #980 push was blocked with `reason: new explicit dep in package.json` on commit whose only package.json additions were the `overrides` security pins. ## §1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files) ### §1.7 Forward-check applied The refinement itself lands as an executable artifact at the earliest reachable channel, not prose: the skip logic is enforced in the pre-push hook path (`packages/core/hooks/checks/prior-art.ts:90-113`) and pinned by paired-negative tests (`packages/core/hooks/checks/prior-art.test.ts:112-176`) that fail if the skip over-reaches (post-block dep still detected, hunk-boundary reset re-arms detection conservatively). The prose (CLAUDE.md:38) changed in the same commit as the hook, honoring the stay-in-sync contract. ### §1.7 Backward-check applied Class of this change = capability-commit detection semantics. Surfaces where the class occurs, each swept: `packages/core/hooks/checks/prior-art.ts` (the only detection implementation — fixed); `.husky/pre-push` + `packages/core/hooks/` shell entry points (grep for a bash duplicate of the dep-detection: none — the bash predecessor was fully ported per prior-art.ts:2-4 header, SWEPT-CLEAN); `CLAUDE.md:38` prose definition (updated in sync); `packages/core/principles/11-build-first-reuse-default.test.ts` (principle test consumes the SSOT register, not the dep-detection regex — grep shows no `isNewDepAdded` import outside hooks/checks, SWEPT-CLEAN); `.github/workflows/audit-self.yml` §7 trailer backstop (validates trailer presence on commits, does not re-implement dep detection — SWEPT-CLEAN). No other surface encodes "what counts as a new dependency".
artyhoo
added a commit
that referenced
this pull request
Jul 11, 2026
…-yaml/markdown-it overrides (#986) Invited follow-up to PR #980. Two commits: CI Node 20 → 22; markdownlint-cli2 ^0.23.0 replacing the two temporary overrides. ## Why - **Node 20 reached EOL 2026-04-30** (verified via endoflife.date API 2026-07-11) — CI ran an unsupported runtime for 2+ months. The '20' pin was never a decision: introduced without rationale in `3f55ee281` (2026-05-07, first CI job) and copy-pasted across 23 jobs. Node 22 = active LTS until 2027-04-30. - The `js-yaml` / `markdown-it` overrides from PR #980 existed ONLY because markdownlint-cli2 0.23.0 requires node>=22 while CI was on 20. With CI on 22, the clean parent bump replaces the forced pins. ## What changed / what deliberately didn't | Surface | Action | |---|---| | 23 × `node-version: '20'` in `.github/workflows/` (4 files) | → `'22'`; actionlint clean | | root `package.json`: markdownlint-cli2 `^0.22.1` | → `^0.23.0` (brings js-yaml 5.2.0 nested + markdown-it 14.2.0 natively) | | root `overrides`: `js-yaml`, `markdown-it` | removed — no longer needed | | `overrides.qs` | **stays** — still unavoidable (latest typed-rest-client pins vulnerable qs) | | f17 matrix `['20','22']` (`audit-self.yml:1222`) | untouched — consumer-compat coverage, not our runtime | | shipped templates + `.nvmrc` (20.19.0) | untouched — consumer CI reads `node-version-file: '.nvmrc'`, cannot drift from our pins (`tests/install-sh/f11-ci-node-version.test.sh` 6/6, `nvmrc-ci-drift.test.sh` 7/7 green). Bumping the consumer-facing `.nvmrc` default is a separate maintainer decision — surfaced, not smuggled in. | ## Verification - No vulnerable version reappears after overrides removal — full-lock check: js-yaml 4.2.0 (@eslint/eslintrc) + 5.2.0 (mdl2 nested), markdown-it 14.2.0, qs 6.15.2, handlebars 4.7.9 (all ≥ Dependabot fixed versions). - **Lint-behavior parity:** markdownlint-cli2 0.22.1 vs 0.23.0 over all 897 tracked `*.md` — error sets byte-identical (160 pre-existing findings, 0 new-only, 0 old-only). The bump changes nothing for pre-commit. - `NODE_ENV=development build:synth-bundle:check` green; `actionlint` clean locally; local node 24 ≥ mdl2's engines floor. ## §1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files) ### §1.7 Skipped: mechanical maintenance — version-pin flips (23 CI pins, 1 devDep range, 2 override removals) with no rule/discipline semantics introduced or extended; enforcement surfaces untouched (verified: tests/install-sh/f11-ci-node-version.test.sh 6/6, nvmrc-ci-drift.test.sh 7/7, actionlint clean).
artyhoo
added a commit
that referenced
this pull request
Aug 7, 2026
…ntical vendor copies (#1277) * fix(prior-art): two capability-detector carve-outs — doc files + byte-identical vendor copies Doc files (*.md) never counted as capability per the CLAUDE.md prose ('doc edits are NOT capability commits') but the LOC triggers lacked the parity — a shipped >=80-LOC doc template tripped the detector (PR #1272). A new file byte-identical to a blob already tracked elsewhere in the tree is a relocation/vendor copy adding no capability by construction (PR #1271 vendored runtime-bridge subset). Both carve-outs land in the shared module (prior-art.ts) so pre-push, CI backstop, and the PR-body squash-survival gate all inherit them; CLAUDE.md prose updated in the same commit to stay in sync per its own 'the prose definition and the hook stay in sync' claim. Prior-art: skipped — refinement of an existing gate's detector, no new capability; mirrors the PR #980 overrides carve-out precedent §1.7: forward — carve-outs align hook with existing CLAUDE.md exemption (no new discipline); backward — all three consumer channels (pre-push substance arm, real-commit backstop CI, pr-body-prior-art gate) share prior-art.ts so no sibling drifts; paired-negative tests added for both carve-outs * test(install-sh): recapture byte-identical baselines after the CLAUDE.md carve-out prose edit Prior-art: skipped — snapshot regeneration after a doc edit, no new capability --------- Co-authored-by: Test <test@example.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes all 16 open Dependabot alerts (triage-first, per-alert rationale below). Two atomic commits: lock/manifest bumps; drizzle fixture pins. No new dependencies — overrides entries and in-range bumps only; not a capability commit.
Per-alert disposition
eslint-plugin-boundaries ^5.0.0 → ^6.0.2inpackages/preset-react-spa/package.json:26— 6.0.2 pins@boundaries/elements 2.0.1→ handlebars 4.7.9. Chosen over also-available ^7.0.2 as the smaller major jump with the same security outcome. The shipped templatepackages/preset-react-spa/templates/eslint.config.react.mjsis unchanged: v6 keeps the explicitly-configured legacyelement-typesrule +boundaries/elementssettings working.overridesin rootpackage.json+packages/core/package.json— unavoidable: latest typed-rest-client (3.0.0) still pins vulnerable qs 6.15.1 exactly (verified against the npm registry).overrides "js-yaml": "4.2.0"— parent markdownlint-cli2 pins exact 4.1.1; its fixed release 0.23.0 requires node>=22 while CI runs node 20, so the parent bump is blocked. Exact spec matches packages/core's direct-dep spec (npm direct-dep override rule).overrides "markdown-it": "^14.2.0"— same markdownlint-cli2 exact-pin reason.npm update(parents allow ^7.x / ~7.29.0).npm update(tsx ~0.28.0, vite ^0.28.0). Root esbuild was already 0.28.1.packages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5,packages/core/research/fixtures/tier1-single-root/package.json:3, stub.../node_modules/drizzle-orm/package.jsonbumped in lockstep. Consuming tests verified version-insensitive (name-based detection;research-plan.jsonhasversion: null) — fixed, not dismissed.Notes
scripts/build-synth-bundle.sh:17uses$ROOT/node_modules/.bin/esbuild), which was already 0.28.1 and is unchanged; the packages/core esbuild bump is a non-feeding transitive.NODE_ENV=development build-synth-bundle.sh --checkgreen after freshnpm ciof both locks.dependency-nodesdefault from["import"]to["import","export","require","dynamic-import"]. Consumers may see new (legitimate)boundaries/element-typesfindings onexport … from/require()/ dynamic-import edges — stricter, not broken.npm lsmarker:invalid: qs@6.15.2under typed-rest-client is the documented override-forced exact-pin violation (the point of the fix); no CI gate runsnpm ls.Verification
format:check,NODE_ENV=development build:synth-bundle:check,render-rules --check,render-rule-index --check, install-shgh-534-arch-boundaries+f17-lint-rules-planted-violation+byte-identical(fingerprints unchanged — no SNAPSHOT_MODE regen needed).npm ci(root) andnpm ci --prefix packages/coreboth exit 0; every touched lock entry has version+resolved+integrity; zero unexpected version changes in either lock diff (only intended packages + their transitive helper chains).§1.7 Self-discipline check (REQUIRED if PR touches discipline-bearing files)
§1.7 Forward-check applied
This PR introduces no new rule; the forward obligation is that each fix lands at the earliest reachable channel and is executable, not prose: vulnerable versions are excluded structurally by manifest constraints —
package.json:6-10(overrides block),packages/core/package.jsonoverrides,packages/preset-react-spa/package.json:26(^6.0.2 floor) — so any futurenpm installcannot silently re-resolve a vulnerable version; regressions fail at install/lock level, before CI.§1.7 Backward-check applied
Class of this change = dependency-version-constraint updates. Surfaces where the class occurs, each swept: root
package-lock.json(all 6 target packages patched, no residual vulnerable entries — verified over the full lock, not the diff);packages/core/package-lock.json(qs/@babel/core/esbuild patched; contains NO handlebars/js-yaml/markdown-it entries → no overrides needed there); fixture manifestspackages/core/detector/fixtures/hono-drizzle-monorepo/apps/api/package.json:5+packages/core/research/fixtures/tier1-single-root/package.json:3+ its stub (bumped in lockstep, internally coherent); other fixture manifests underpackages/core/**/fixtures/(swept — no other pinned occurrences of affected packages); shipped templates +install.sh(grep: zero version pins of affected packages); synth bundlepackages/core/synthesizer/synth-and-wire.bundle.mjs(not fed by the core esbuild entry —scripts/build-synth-bundle.sh:17;--checkgreen); install fingerprints/baselines (tests/install-sh/byte-identical.test.shgreen — unshifted).