mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-11-01 16:29:45 +00:00
Oliver Kieselbach
7fd4a4fe62
Lockfile-only bumps of transitive dependencies, all inside the ranges their
parents already declare (express ^2.3.0 / ^6.16.0, ajv ^3.0.1):
- body-parser 2.3.0 -> 2.4.0 (mcp via express), GHSA-27r3-jxmh-p828;
pulls iconv-lite 0.7.2 -> 0.7.3 with it
- qs 6.16.0 -> 6.16.1 (mcp via express/body-parser), GHSA-6pq8-jhm2-2vcw
- fast-uri 3.1.8 -> 3.1.9 (mcp and rules/scripts via ajv),
GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr,
GHSA-333x-w4r6-6crp
The MCP fast-uri override is a security floor (7df208fa), so it moves from
^3.1.4 to ^3.1.9. qs stays on 6.16.1 rather than 6.17.0, which is a day old
and inside the 7-day cooldown. The MCP lockfile was written with npm 11.21.1
so the libc fields Dependabot added in #192 survive.
npm audit: 0 vulnerabilities in mcp, web, rules/scripts and tools/quality.
MCP: tsc, build, lint (0 warnings), knip clean; 1057 tests pass.
rules/scripts/validate.js passes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>