fix(deps): resolve the brace-expansion audit advisory - #330
Merged
Conversation
npm audit fails CI on every branch, including main, over one high severity advisory in transitive brace-expansion 5.0.6. Lockfile-only bump to 5.0.7; no direct dependency changed.
🗺️ StyleProof report📊 View the side-by-side visual report →A navigable affordance was removed without acknowledgement — repair or acknowledge it; visual approval cannot clear this failure. |
This was referenced Jul 21, 2026
BenSheridanEdwards
added a commit
that referenced
this pull request
Jul 22, 2026
Cut 4.7.0 from the six commits merged since 4.6.3. Two are feature work, so this is a minor bump; the version bump is the Release workflow's signal to tag, publish to npm, and cut the GitHub Release on merge. Added - Reports publish through the git-data API (#328). - styleproof-init prunes reports by API with a retention + size-budget sweep (#329). - CERTIFICATION_FAILED dogfooded end-to-end (#327). Security - Cleared two high-severity transitive advisories: brace-expansion 5.0.6→5.0.7 (#330) and fast-uri 3.1.3→3.1.4, GHSA-v2hh-gcrm-f6hx (#331). Verified locally: build, typecheck, lint, format:check, privacy:check all clean; full node --test suite 630/630 with a complete install. Co-authored-by: StyleProof Test <styleproof@example.test> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why does this feature exist?
The CI workflow's dependency audit step fails on every branch in the repository, including main, over one high severity advisory in transitive
brace-expansion5.0.6. Until it clears, every PR shows a red CI check that has nothing to do with its diff.What changed?
package-lock.jsononly:brace-expansion5.0.6 to 5.0.7 vianpm audit fix. No direct dependency changed, no code changed.Behavioural Proof (with video and screenshots)
Not applicable: a lockfile-only transitive bump with no rendered surface. Proof is
npm auditreporting 0 vulnerabilities after the bump, and the full test suite passing against the updated tree.Verification Summary
npm audit: 1 high severity vulnerability before, 0 after.npm run buildand fullnode --testsuite: 608 pass, 0 fail.package-lock.json.