chore(deps): npm audit fix — patches 3 dev-only transitive vulns#23
Merged
Conversation
Lockfile-only refresh resolves all three dependabot alerts on the default branch: GHSA-v39h-62p7-jpjc fast-uri 3.1.0 → 3.1.2 (high; host confusion) GHSA-q3j6-qgpj-74h6 fast-uri 3.1.0 → 3.1.2 (high; path traversal) GHSA-v2v4-37r5-5v8g ip-address 10.1.0 → 10.2.0 (moderate; XSS) Both chains are dev-only: fast-uri ← ajv (devDependency, JSON-schema validator used in CI) ip-address ← puppeteer (devDependency, demo-record tool only) The published agent-chorus package has zero runtime dependencies (see `files:` list in package.json — record_demo.js is not shipped), so end users were never exposed. The alerts were a noise-on-default- branch signal, not exploitable in any chorus-shipped code path. This patch keeps that signal clean so a future real alert stands out. No package.json edit, no version bump, no behavior change. Lockfile- only diff. Conformance + 164 cargo tests green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lockfile-only refresh closing the 3 dependabot alerts on the default branch.
fast-uri3.1.0 → 3.1.2fast-uri3.1.0 → 3.1.2ip-address10.1.0 → 10.2.0Impact
Both chains are dev-only:
The published
agent-choruspackage has zero runtime dependencies (seefiles:list in package.json —record_demo.jsis not shipped). End users installingagent-chorusfrom npm or crates.io were never exposed. The alerts represented dashboard noise, not exploitable risk in any chorus-shipped code path.Why fix anyway: keeping the security dashboard clean means future real alerts stand out instead of getting lost in known-noise.
Changes
package-lock.json— lockfile-only diff (14 insertions / 14 deletions).package.jsonedits.Test plan
npm audit→found 0 vulnerabilities(was 4: 2 high + 2 moderate)cargo test --manifest-path cli/Cargo.toml→ 164 passbash scripts/conformance.sh→ conformance complete, Node ≡ Rustchorus --version→0.16.0(unchanged)chorus list --agent codex→ works🤖 Generated with Claude Code