chore(deps): bump brace-expansion and fast-uri to clear the audit gate - #17
Merged
Conversation
✅ Deploy Preview for strong-fudge-f04a16 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
MasterPlayspots
added a commit
that referenced
this pull request
Aug 17, 2026
…caught it (#24) * docs(changelog): 1.2.5 through 1.2.7, plus the gate that should have caught it THE MEASURED GAPS 1. Five tags exist (v1.2.3 ... v1.2.7). One GitHub release does (v1.2.5). 2. CHANGELOG ended at 1.2.4 while npm served 1.2.7 — three releases with no entry. 3. Unreleased commits sit on main after v1.2.7. WHAT CHANGED CHANGELOG: 1.2.5, 1.2.6 and 1.2.7 written from the commit log, not from memory. Tone follows 1.2.7's own name — "honest short descriptions". bin/changelog-gate.js: the previous prepublishOnly check only asked whether CHANGELOG.md EXISTED. It did, continuously, while three versions shipped without an entry. A file-exists check cannot catch that; it was green the whole time. The new gate requires a NON-EMPTY "## [<version>]" section. .github/workflows/release.yml: a tag now creates its GitHub release, with the changelog section as the release notes. Writing release notes twice means writing them differently, and then neither is authoritative. PROVEN, not asserted: version present + section filled -> exit 0 version absent from CHANGELOG -> exit 1 section present but empty -> exit 1 npm test green, npm audit: 0 vulnerabilities CORRECTIONS to the task description: · It claims TWO unreleased commits after v1.2.7. There are THREE — the extra one is 4d6fb59 "fix: resolve high severity npm vulnerability". A security fix is sitting on main, unpublished; npm still serves 1.2.7 without it. Recorded under [Unreleased]. · plugin.json does not exist on main, so it cannot be at 1.2.7 as claimed. package.json and server.json are both 1.2.7 — no drift between those two. · The six "orphan" branches are all genuinely merged (PRs #4, #15, #17, #18, #19, #20); only the refs remain. Deleting them is K4 — listed, not done. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(deps): regenerate package-lock.json — it pinned nothing CI was red on this PR. It is red on `main` too, for the same reason and independently of anything in this branch: a clean `main` worktree fails `npm ci` identically. npm error `npm ci` can only install packages when your package.json and npm error package-lock.json are in sync. npm error Missing: @commitlint/cli@21.2.2 from lock file npm error Missing: @modelcontextprotocol/sdk@1.30.0 from lock file npm error Missing: zod@4.4.3 from lock file ... 20 more The lock file was not merely stale. It carried NO ENTRY for either runtime dependency — @modelcontextprotocol/sdk and zod — and none for the devDependency tree at all. It pinned nothing. Every CI job died at `npm ci` before running a single test, which is why coverage, e2e, lint, security and all three test matrix legs failed within 17 seconds. Regenerated with `npm install --package-lock-only`. The resulting versions match exactly what package.json already specifies (sdk 1.30.0, zod 4.4.3), so this changes no dependency — it records the ones that were already chosen. npm ci --dry-run passes npm test green npm audit 0 vulnerabilities Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.