Skip to content

fix(deps): update remaining vulnerable packages - #14

Merged
semantic-craft merged 1 commit into
mainfrom
codex/security-remaining-dependencies
Jul 24, 2026
Merged

fix(deps): update remaining vulnerable packages#14
semantic-craft merged 1 commit into
mainfrom
codex/security-remaining-dependencies

Conversation

@semantic-craft

Copy link
Copy Markdown
Owner

Summary

  • update direct esbuild from 0.21.5 to patched 0.28.1
  • update transitive protobufjs from 7.6.1 to patched 7.6.5 within @google/genai’s declared range
  • deduplicate Vite onto the same patched esbuild copy
  • remove transitive packages no longer used by protobufjs 7.6.5

Closes #10.
Closes #11.

Validation

  • npm ci: PASS
  • build and typecheck: PASS
  • Vitest: 45 tests passed
  • integration-test compilation: PASS
  • npm ls: esbuild 0.28.1 and protobufjs 7.6.5 confirmed
  • production npm audit: 0 vulnerabilities
  • full-history and tracked-tree Gitleaks: 0 leaks

The remaining low-severity Mocha/jsdiff audit chain is upstream-constrained and tracked separately in #13.

@semantic-craft
semantic-craft merged commit 818c905 into main Jul 24, 2026
4 checks passed
@semantic-craft
semantic-craft deleted the codex/security-remaining-dependencies branch July 24, 2026 04:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security(deps): update the remaining esbuild dependency chain security(deps): update protobufjs after failed Dependabot run

1 participant