Problem
The TypeScript client's development lockfile resolves vulnerable test tooling:
- direct
vitest@2.1.9 is affected by critical advisory GHSA-5xrq-8626-4rwp;
- transitive
vite@5.4.21 is affected by high advisory GHSA-fx2h-pf6j-xcff.
The production dependency graph is clean, but the release gate requires high-severity development vulnerabilities to be resolved before 0.3.0.
Reproduction
cd clients/typescript
bun install --frozen-lockfile
bun audit --audit-level high
This reports one critical and one high vulnerability. npm audit cannot inspect this project because it uses bun.lock, not package-lock.json; the lock-aware check is bun audit.
Acceptance criteria
- update Vitest to at least 3.2.6;
- ensure every resolved Vite version is at least 6.4.3;
- add
bun audit --audit-level high to TypeScript CI and release validation;
- pass frozen install, typecheck, all live-database tests, build, and package smoke;
- make both full and production Bun audits report no high-severity vulnerabilities.
Problem
The TypeScript client's development lockfile resolves vulnerable test tooling:
vitest@2.1.9is affected by critical advisoryGHSA-5xrq-8626-4rwp;vite@5.4.21is affected by high advisoryGHSA-fx2h-pf6j-xcff.The production dependency graph is clean, but the release gate requires high-severity development vulnerabilities to be resolved before 0.3.0.
Reproduction
cd clients/typescript bun install --frozen-lockfile bun audit --audit-level highThis reports one critical and one high vulnerability.
npm auditcannot inspect this project because it usesbun.lock, notpackage-lock.json; the lock-aware check isbun audit.Acceptance criteria
bun audit --audit-level highto TypeScript CI and release validation;