chore(deps): finalize security overrides and regenerate lockfile (#1718)

Browse source

npm does not reliably apply these transitive overrides to an existing
lockfile (bare and targeted overrides via install/update leave residual
vulnerable copies). This regenerates the lockfile from scratch with
version-targeted overrides so every copy of the affected packages
resolves to a patched version.

Resolves Dependabot alerts:
- esbuild #121 (-> 0.28.1)
- minimatch #69, #66, #61 (3.x -> 3.1.5)
- @babel/core #132 (-> 7.29.7; completes the partial fix from #1712)
Also pins js-yaml overrides (3.15.0 / 4.2.0) to prevent regression.

Supersedes #1713, #1714, #1715. Part of #1706.

Verified: 0 vulnerable copies across all advisories; build + client (535)
+ cli tests pass; lockfile internally consistent.


Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

Cliff Hall 2026-07-17 20:41:25 -04:00 • committed by GitHub

parent ebd0550fec

commit c146313bb3

No known key found for this signature in database

GPG key ID: B5690EEEBB952194

1 changed files with 1644 additions and 1981 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3393

package-lock.json generated

View file

File diff suppressed because it is too large Load diff