fix(deps): refresh lua-shopping-assistant lockfile (transitive security bumps) - #21
Merged
Merged
Conversation
…t alerts npm audit fix (no --force) on the transitive tree, bumping each vulnerable package to its highest patched version: - protobufjs -> 7.6.5 (clears critical GHSA + the option-parser DoS chain) - uuid -> 13.0.2, minimatch -> 10.2.5, plus axios sub-deps Lockfile-only; package.json unchanged (no direct-dep bump, no overrides). lua-cli unchanged. Pre-existing tsc errors in EcommerceTool.ts are unrelated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves remaining open Dependabot alerts for
lua-shopping-assistantthat had no dedicated Dependabot PR.npm audit fix(no--force) on the transitive tree, each vulnerable package bumped to its highest patched version:Lockfile-only.
package.jsonunchanged (no direct-dep bump, no injectedoverrides); lua-cli unchanged. Alerts for packages already absent from the lockfile (websocket-driver, @grpc/grpc-js, react-router, tar, socket.io-parser, brace-expansion, mdast-util-to-hast) will auto-dismiss on re-scan. Pre-existingtscerrors in EcommerceTool.ts are unrelated to this change and present on master.🤖 Generated with Claude Code
Note
Low Risk
No application source changes; risk is limited to transitive dependency behavior in install/runtime, which is the intended security remediation path.
Overview
Lockfile-only update for
lua-shopping-assistantafternpm audit fix—package.jsonand direct dependencies (includinglua-cli) are unchanged.Transitive versions move to patched releases, notably protobufjs 7.6.5 (drops
@protobufjs/inquirefrom the tree), uuid 13.0.2, axios 1.18.1 (adds nested proxy-agent deps), and bumps across the Vercel AI SDK stack (ai,@ai-sdk/gateway,@ai-sdk/provider-utils), @opentelemetry/core, and smaller packages (eventsource-parser,brace-expansion). Intended to clear open Dependabot alerts without addingoverridesor forcing major direct-dep changes.Reviewed by Cursor Bugbot for commit c68325b. Bugbot is set up for automated code reviews on this repo. Configure here.