Repository navigation
fix: restore complete security checks for dependency updates - #4
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependency update PRs currently stop before their parser security regressions: the low-severity audit gate rejects the retired ESLint/YAML dependency chain, while CodeQL default setup produces no Actions or JavaScript analysis for Dependabot-authored PRs.
This maintenance PR removes the affected tool chain with current ESLint and plugins, updates the compatible brace-expansion, HTTP cache and source-map lock entries, and keeps the existing ES3 lint rules and severities through flat configuration. Node/browser pragmas move into the corresponding file configuration; seven regression tests verify that JS, CLI, JSON and HTML checks remain active. The old YAML nodes and ESLint table/fast-uri chain behind #2 and #3 are upgraded or removed through normal dependency resolution.
The original audit-level=low gate and ODS security assertions are unchanged. Corpus checksum verification and the complete Node22/24/26, Bun and Deno corpus matrices remain required. The prepared CI changes avoid shared Actions cache writes, retain exact release-asset comparison, and replace branch-rewriting automation with a read-only relationship check. No package release or runtime-version change is included.
Validation: fresh normal npm ci; public npm audit --audit-level=low --package-lock-only reports zero vulnerabilities; make lint reports zero errors; tooling, ODS, table-style, CJS/ESM MiniFAT and publish-guard checks pass. Full remote matrices and both actual CodeQL configurations must pass before landing. Existing bot PRs #2/#3 remain open until their changes are demonstrably covered by a merged, fully scanned result.
CodeQL's default-setup Dependabot limitation is documented by the project maintainers: github/codeql-action#2858. The repository default-setup languages, queries, schedule, threat model and protections remain active.