Skip to content

fix(deps): bump compression from 1.8.1 to 1.8.2 in /docs-site - #171

Merged
Atom-oh merged 1 commit into
devfrom
dependabot/npm_and_yarn/docs-site/compression-1.8.2
Oct 13, 2026
Merged

fix(deps): bump compression from 1.8.1 to 1.8.2 in /docs-site#171
Atom-oh merged 1 commit into
devfrom
dependabot/npm_and_yarn/docs-site/compression-1.8.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps compression from 1.8.1 to 1.8.2.

Release notes

Sourced from compression's releases.

v1.8.2

Important

What's Changed

New Contributors

Full Changelog: expressjs/compression@v1.8.1...v1.8.2

Changelog

Sourced from compression's changelog.

1.8.2

Commits
  • 0f97074 1.8.2 (#287)
  • 151f63e fix: destroy compression stream on response close
  • 0a76495 fix: match Cache-Control no-transform directive case-insensitively (#286)
  • c17b6e5 docs: update outdated Brotli note and fix npm install docs URL (#276)
  • 112911a chore(ci): npm-publish via reusable workflows (#269)
  • 1bf5eb0 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#267)
  • d8fe64d build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#266)
  • b218ff5 build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (#265)
  • 8a1cf8e build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#268)
  • 4a19855 build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#257)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for compression since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
fix(deps): bump compression from 1.8.1 to 1.8.2 in /docs-site
d662cd3 
Bumps [compression](https://github.com/expressjs/compression) from 1.8.1 to 1.8.2.
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@v1.8.1...v1.8.2)

---
updated-dependencies:
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026
@dependabot
dependabot Bot deployed to ci-review-auto October 12, 2026 14:11 Active
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

🤖 AI Code Review (two independent reviewers)

_Reviewer responses: codex/ALL claude/ALL _

Status: PASSED — No blocking issues found

Base verification confirms the panels' context: compression is a transitive dependency in docs-site/package-lock.json (range ^1.8.1, pinned at 1.8.1 in BASE, pulled in by Docusaurus's dev-server stack), so a lockfile-only bump to 1.8.2 requires no package.json change and is internally consistent with the PR title. Here is the synthesized chair review.

Chair Review — PR #171: fix(deps): bump compression 1.8.1 → 1.8.2 in /docs-site

1. Summary

This PR regenerates docs-site/package-lock.json to move the transitive dependency compression from 1.8.1 to 1.8.2 — a classic Dependabot-style patch bump. Chair verification against BASE confirms compression is locked at 1.8.1 under the semver range ^1.8.1, so the bump needs no docs-site/package.json change and leaves the four security overrides untouched. Both panel models independently found no CRITICAL or MAJOR issues on any lens; the only caveat, shared by both, is that the lockfile hunk body was omitted from the diff delivery, so resolved URLs and integrity hashes could not be byte-inspected — a gap that the repo's Merge Verify workflow (npm ci + build on any docs-site/ change) materially mitigates, since npm ci fails on any lock/manifest or integrity mismatch.

2. Issues per lens

L2 — Code correctness

  • MINOR (both models noted the same limitation): The lockfile hunk content was withheld ([lockfile content omitted]), so the regenerated resolved versions, registry URLs, and integrity hashes could not be directly reviewed. Both panels correctly treated this as an evidence gap, not a defect — claude-ALL verified the compensating control (.github/workflows/merge-verify.yml runs npm ci && npm run typecheck && npm run build on docs-site changes), and chair verification confirms the BASE range ^1.8.1 admits 1.8.2 without manifest drift. No executable application code is touched.

L3 — Security / AWS mutation safety

  • No findings (both models agree). No AWS SDK calls, IAM policies, Terraform, agent tools, or secrets are in scope; ADR-005's frozen-mutation boundary is untouched. The residual supply-chain concern is the same unreviewable-hunk gap as L2, with the same npm ci integrity-check mitigation. compression 1.8.2 is a routine upstream patch of a widely-used Express middleware consumed only at docs-site dev/build time.

L4 — Observability / data-integration correctness

  • No findings (both models agree). No Steampipe SQL, CIS checks, collectors, AgentCore diagnosis logic, or schema/migrations are touched.

L5 — Docs / ADR consistency

  • No findings (both models agree). docs-site/package.json, its overrides block, and the README's dependency-update procedure remain accurate after this patch; no ADR claim is affected. claude-ALL's suggestion to cite the motivating advisory in the PR body is reasonable hygiene but not a repo-rule violation (the CHANGELOG rule doesn't require a bullet for a docs-site transitive lock bump, and no entry was duplicated or renumbered).

Panel agreement note: both models converged on "no blocking findings + unreviewable hunk body is a coverage caveat, not a defect." The chair verified this against BASE rather than relying on agreement: the dependency, range, and compensating CI check were all confirmed in the worktree. Codex's mention of an ENOSPC sandbox failure during its own inspection does not alter the gate — claude-ALL and the chair both completed the base reconciliation it could not.

3. Suggestions

  • In the PR description, state the upstream release/advisory motivating the bump (compression 1.8.2 changelog), per the dependency-hygiene practice in docs-site/README.md.
  • Nothing else — the existing Merge Verify gate already provides the install/build proof this lockfile change needs.

4. Verdict

No CRITICAL or MAJOR findings from either panel survived verification, and the image manifest is empty with status: complete (no images, no deletions, no unavailable/omitted entries), so no HEAD pixel inspection was required.

IMAGE_COVERAGE: NOT_REQUIRED

Triggered by commit d662cd3ddc13c38e0f69664fce777db5ae35d35b · workflow: .github/workflows/pr-review.yml

@Atom-oh
Atom-oh merged commit f790b11 into dev Oct 13, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/docs-site/compression-1.8.2 branch October 13, 2026 09:33

This branch was successfully deployed

1 active deployment
ci-review-auto — d662cd3d Deployed Oct 12, 2026 by dependabot[bot] via AI Code Review #691
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Atom-oh