fix: resolve npm audit failures - #1350
Merged
HarithaVattikuti merged 1 commit intoAug 18, 2026
Merged
Conversation
Bumps transitive dependencies to patched versions: - brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895) - js-yaml 3.15.0 -> 3.15.1 (GHSA-5p4m-2wfm-xmqj) - undici 6.27.0 -> 6.28.0 (GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm) Refreshes .licenses/ cache for the updated packages and rebuilds dist/. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates transitive npm dependencies to clear basic-validation.yml’s npm audit --audit-level=high step, and refreshes the checked-in build artifacts and license metadata accordingly.
Changes:
- Bumps vulnerable transitive dependencies in
package-lock.json(brace-expansion, js-yaml, undici). - Rebuilds
dist/bundles to reflect updated dependency code (notably undici + brace-expansion logic changes). - Updates licensed dependency metadata for bumped packages.
Reviewed changes
Copilot reviewed 2 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package-lock.json | Updates resolved transitive dependency versions to remediate npm audit advisories. |
| dist/setup/index.js | Rebuilt bundle output reflecting updated transitive deps (undici/brace-expansion changes). |
| dist/cache-save/index.js | Rebuilt bundle output reflecting updated transitive deps (undici/brace-expansion changes). |
| .licenses/npm/undici.dep.yml | Updates recorded undici version for license tracking. |
| .licenses/npm/brace-expansion.dep.yml | Updates recorded brace-expansion version for license tracking. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
HarithaVattikuti
changed the title
gowridurgad
approved these changes
Aug 18, 2026
priya-kinthali
approved these changes
Aug 18, 2026
gdams
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the failing
basic-validation.ymlaudit step (npm audit --audit-level=high) caused by known advisories in transitive dependencies.Vulnerabilities fixed
brace-expansion5.0.8 → 5.0.9 — GHSA-rgw5-rvv9-x895js-yaml3.15.0 → 3.15.1 — GHSA-5p4m-2wfm-xmqjundici6.27.0 → 6.28.0 — GHSA-8xcm-r25x-g524, GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcmAll are patch-level, non-breaking transitive bumps via
npm audit fix; nopackage.jsonchanges required.Validation
npm audit --audit-level=high→ 0 vulnerabilitiesnpm run build→dist/rebuiltnpm run format-check→ passnpm run lint→ passnpm test→ 210/210 tests passlicensed cache+licensed status→ 48 dependencies checked, 0 errors