From e8e472b473323d83f8915469eba6a9dd527bfe07 Mon Sep 17 00:00:00 2001 From: AstroHan Date: Thu, 3 Sep 2026 02:57:32 +0800 Subject: [PATCH] fix(deps): clear the CLI production audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `fast-uri` (high) and `qs` (moderate) advisories landed on transitive production dependencies of the CLI, so `release:cli:pack` fails its audit gate and every job that packages the CLI goes red — main included. The lockfile moves to the patched versions, and `packages/cli/THIRD_PARTY_NOTICES.txt` moves with it, because the notice file records the exact versions the audit just changed and its own check fails otherwise. The three open Dependabot PRs do not cover this: #4586 and #4587 bump the same packages in `packages/eval/harbor/deepseek-harness-toolchain`, a different lockfile, and #4585 is a dev dependency the production audit does not read. `@xmldom/xmldom` comes along here because `npm audit fix` resolves the root lockfile as a whole; if #4585 lands first this hunk is already what it wants. Generated-by: Claude Code --- package-lock.json | 18 +++++++++--------- packages/cli/THIRD_PARTY_NOTICES.txt | 4 ++-- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1f8d76d718..863e38022c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5069,9 +5069,9 @@ "license": "Apache-2.0" }, "node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "dev": true, "license": "MIT", "engines": { @@ -8114,9 +8114,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", @@ -11896,9 +11896,9 @@ } }, "node_modules/qs": { - "version": "6.15.3", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz", - "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==", + "version": "6.16.0", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", diff --git a/packages/cli/THIRD_PARTY_NOTICES.txt b/packages/cli/THIRD_PARTY_NOTICES.txt index f1950bb8bd..7e16844036 100644 --- a/packages/cli/THIRD_PARTY_NOTICES.txt +++ b/packages/cli/THIRD_PARTY_NOTICES.txt @@ -4108,7 +4108,7 @@ SOFTWARE. ================================================================================ -Package: fast-uri@3.1.5 +Package: fast-uri@3.1.7 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: git+https://github.com/fastify/fast-uri.git @@ -6483,7 +6483,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI ================================================================================ -Package: qs@6.15.3 +Package: qs@6.16.0 Declared license: BSD-3-Clause Selected license: BSD-3-Clause Repository: https://github.com/ljharb/qs.git