[COVAL-5616] Bump dependencies to clear 15 Dependabot alerts

[callumreid]

Clears all 15 open Dependabot alerts on this repo. Oneleet SLA breach was due 2026-09-03 (the eight HIGH alerts had 3.2 days left).

Only one advisory touches a direct dependency (diff, the sole runtime package affected). The other ten are transitive-only and are pinned with npm overrides.

Direct dependency bump

Package	Old	New	Scope	Alerts cleared
diff	7.0.0	8.0.4	runtime	#1 (low — jsdiff DoS in parsePatch/applyPatch)

@types/diff (^6.0.0) was removed: diff v8 ships its own type definitions and the DefinitelyTyped package is now a stub ("diff provides its own type definitions, so you do not need this installed"). The only API used is createTwoFilesPatch in src/files.ts, whose signature is unchanged in v8; npm run typecheck passes against the bundled types.

Transitive-only advisories (npm overrides)

Package	Old	New	Alerts cleared
brace-expansion (1.x)	1.1.12	1.1.18	#24 (high — DoS via exponential-time expansion)
brace-expansion (2.x)	2.0.2	2.1.4	#25 (high — same)
brace-expansion (5.x)	5.0.4	5.0.9	#23 (high — same)
js-yaml (3.x)	3.14.2	3.15.2	#26, #35 (high — merge-key / !!omap quadratic CPU), #22 (moderate — merge-key aliases)
js-yaml (4.x)	4.1.1	4.3.2	#27, #34 (high — same), #21 (moderate — same)
flatted	3.4.1	3.4.4	#2 (high — prototype pollution via parse())
picomatch (2.x)	2.3.1	2.3.2	#6 (moderate — method injection in POSIX character classes)
picomatch (4.x)	4.0.3	4.0.7	#5 (moderate — same)
esbuild	0.27.3	0.28.2	#19 (low — arbitrary file read via dev server on Windows)
@babel/core	7.29.0	7.29.7	#20 (low — arbitrary file read via sourceMappingURL comment)

All ten are dev scope; diff is the only advisory reaching the published package.

Why the overrides are scoped per major line

brace-expansion, js-yaml and picomatch each have two or three major lines resolved simultaneously in this tree, and the advisories have separate patched versions per line. The overrides use the name@range key form so each line is bumped to its own patched version rather than being collapsed onto one major.

This matters most for js-yaml: @istanbuljs/load-nyc-config (Jest coverage) depends on js-yaml@^3.13.1 and uses the v3 API, which safeLoad removal in v4 would break. The js-yaml@^3.0.0 → ^3.15.1 override keeps it on the 3.x line while eslint/@eslint/eslintrc independently move to 4.3.2. Verified in the regenerated lockfile: 3.x resolves to 3.15.2, 4.x to 4.3.2.

Note on esbuild

tsup@8.5.1 declares esbuild@^0.27.0, so the override deliberately moves it past its declared range (tsx already wants ~0.28.0, so this also collapses two esbuild copies into one). npm run build and the CI smoke test were run explicitly to confirm tsup works against esbuild 0.28.2 — both pass.

Nothing left unfixed

All 15 alerts have an upstream patched version available and all 15 are addressed. No advisory was force-suppressed, ignored, or dismissed, and no npm audit exception was added.

Verification

Run against a clean node_modules on Node v22.23.1 / npm 10.9.8:

Command	Result
npm install (lockfile regenerated)	464 packages, found 0 vulnerabilities
npm ci	reproduces the lockfile cleanly, found 0 vulnerabilities
npm run typecheck	pass (tsc --noEmit, exit 0)
npm run lint	pass (no ESLint output)
npm run format:check	pass — "All matched files use Prettier code style!"
npm test	pass — 6 suites, 78/78 tests
npm run build	pass — tsup v8.5.1, ESM + DTS build success
CI smoke test (import('./dist/index.js'))	pass (exit 0)
npm audit --omit=dev	found 0 vulnerabilities
npm audit (including dev)	found 0 vulnerabilities

Resolved versions were also read back out of the regenerated package-lock.json to confirm every entry sits at or above its patched threshold, rather than relying on the audit summary alone.

[borgesius]

Dependency remediation looks good; Node 20/22 checks are green and the changes are scoped to package metadata and lockfile updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Team

Run ID: 8f637016-e809-4929-9c8e-f5317df825e4

📥 Commits

Reviewing files that changed from the base of the PR and between bc25e78 and 7bd2cf5.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json and included by **/*

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The package manifest upgrades diff from ^7.0.0 to ^8.0.3 and removes @types/diff. It adds overrides for selected versions of @babel/core, brace-expansion, esbuild, flatted, js-yaml, and picomatch. The MIT license remains unchanged.

Merge Risk: 🔵 Low · up to 7bd2c

The PR upgrades the runtime dependency and pins current transitive dependencies to patched versions, with installation, tests, builds, and audits passing. It is mergeable with owner awareness because future dependency changes could introduce an uncovered vulnerable range unless the override policy is maintained or automated.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Title check	❌ Error	The title accurately describes the dependency updates, but it does not follow the required format. [COVAL-5616] does not match the permitted [COV-XXXX] Linear ticket format, and the title is not a…	Use a valid Linear ticket format such as [COV-5616] Bump dependencies to clear 15 Dependabot alerts, or use a Conventional Commit title such as chore(deps): bump dependencies to clear 15 Dependabot alerts.

Full details: Title check

Explanation

The title accurately describes the dependency updates, but it does not follow the required format. [COVAL-5616] does not match the permitted [COV-XXXX] Linear ticket format, and the title is not a Conventional Commit.

• Fix all pre-merge checks with AI

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed: one or more packages not found in the registry.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}