chore(deps): finalize security overrides and regenerate lockfile#1718
Merged
Conversation
npm does not reliably apply these transitive overrides to an existing lockfile (bare and targeted overrides via install/update leave residual vulnerable copies). This regenerates the lockfile from scratch with version-targeted overrides so every copy of the affected packages resolves to a patched version. Resolves Dependabot alerts: - esbuild #121 (-> 0.28.1) - minimatch #69, #66, #61 (3.x -> 3.1.5) - @babel/core #132 (-> 7.29.7; completes the partial fix from #1712) Also pins js-yaml overrides (3.15.0 / 4.2.0) to prevent regression. Supersedes #1713, #1714, #1715. Part of #1706. Verified: 0 vulnerable copies across all advisories; build + client (535) + cli tests pass; lockfile internally consistent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1
This was referenced Jul 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Finalizes the transitive-dependency security overrides by regenerating
package-lock.jsonfrom scratch.Why this PR exists: npm does not reliably apply newly-added overrides to an existing lockfile — bare overrides and version-targeted overrides applied via
npm install/npm update/--package-lock-onlyall leave residual vulnerable copies of nested deps in place. The only reliable fix is a clean regeneration with the overrides present, which forces every copy to the patched version.Resolves
Supersedes #1713 (js-yaml — already resolved), #1714 (esbuild), #1715 (minimatch). Part of #1706.
Verification
npm run buildpasses; client tests (535) and cli tests pass.npm install --package-lock-onlyproduces no further change (lockfile internally consistent).The lock diff is large because it is a full re-resolution — this is the honest cost of applying these transitive overrides correctly.
🤖 Generated with Claude Code
https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1