From 6c9cc2352af91f0eff724a556f0087eed7ed4057 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Sun, 16 Aug 2026 16:34:32 +0200 Subject: [PATCH 1/2] fix(repo): remove self-referencing node_modules symlink that broke npm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A tracked symlink node_modules -> /home/g/dev/datacat/node_modules (reintroduced in d18eb00) made every npm command at the repo root fail with ELOOP. It slipped past .gitignore because 'node_modules/' only matches directories — drop the trailing slash so symlinks are caught too. Co-Authored-By: Claude Fable 5 --- .gitignore | 2 +- node_modules | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) delete mode 120000 node_modules diff --git a/.gitignore b/.gitignore index d24c08b7..9b6a48a0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,5 @@ # Dependencies -node_modules/ +node_modules .pnp .pnp.js .yarn/install-state.gz diff --git a/node_modules b/node_modules deleted file mode 120000 index 28240cb6..00000000 --- a/node_modules +++ /dev/null @@ -1 +0,0 @@ -/home/g/dev/datacat/node_modules \ No newline at end of file From 16d30d259b5428909f20e36d9dd36711e8b8da4b Mon Sep 17 00:00:00 2001 From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com> Date: Fri, 21 Aug 2026 06:15:04 +0200 Subject: [PATCH 2/2] fix(deps): bump js-yaml and nanoid past open Dependabot highs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In-range transitive bumps in frontend/package-lock.json, no manifest changes: js-yaml 4.2.0 -> 4.3.1 and 3.14.2 -> 3.15.1 (alerts #196/#197, prototype pollution, high) and nanoid 3.3.17 -> 3.3.18 (alert #199, infinite loop with zero size, high). Closes every open frontend alert except @opentelemetry/core #137, which stays pinned to 1.x by the contentlayer effect-ts chain (build-time only, no untrusted baggage headers — goes away with contentlayer). Co-Authored-By: Claude Fable 5 --- frontend/package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 3a0b15aa..e57ea4c4 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -7285,9 +7285,9 @@ } }, "node_modules/gray-matter/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "license": "MIT", "dependencies": { "argparse": "^1.0.7", @@ -8215,9 +8215,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", @@ -9894,9 +9894,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.17", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", - "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "funding": [ { "type": "github",