[luv-legion-650] Clear the undici advisories and land Dependabot #641-#649

.github/workflows/build-daemon.yml

@@ -171,7 +171,7 @@ jobs:
           gzip -9 -c "$BIN" > "failproofaid-${{ matrix.platform }}.gz"
           ls -l "failproofaid-${{ matrix.platform }}.gz"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: failproofaid-${{ matrix.platform }}
           path: failproofaid-${{ matrix.platform }}.gz

.github/workflows/build-image.yml

@@ -47,7 +47,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/publish.yml

@@ -175,7 +175,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           pattern: failproofaid-*
           path: release-assets

CHANGELOG.md

@@ -28,6 +28,8 @@
 - Let `failproofai config` continue with no policy bundles ticked. The "What should we guard against?" step required at least one selection, so anyone who wanted only their own custom policies — or who intended to choose bundles later — was stuck on it with no way forward and nothing on screen but "Select at least 1". The empty set was already supported everywhere downstream (`installHooksImpl`'s explicit-array path documents itself as "may be empty", `replace: true` makes it the full enabled set, `summarize([])` renders "none"), so only the wizard's own guard was in the way. Hooks still install, so enforcement can be switched on later without re-running setup, and the review screen now reads "none enabled (add later: failproofai policies --install)" rather than "0 enabled" so a deliberate choice doesn't look like a dropped one. The assistants step keeps its minimum on purpose: an empty CLI list there does *not* mean "no assistants", because `installHooksImpl` falls back to `["claude"]`, so waving it through would silently install for a CLI nobody picked. (#632)
 
 ### Dependencies
+- Bump the `undici` override from 7.28.0 to 7.29.0, clearing the five remaining advisories that kept the Supply Chain gate red on every open PR: GHSA-4cwx-7wf7-3272 (high, CVSS 7.4 — cross-user information disclosure and a parse-time crash via degenerate private cache directives), GHSA-jr45-8vmc-qm54 (5.9, the same disclosure via whitespace around `=` in `Cache-Control`), GHSA-8xcm-r25x-g524 (4.8, downstream response desynchronization via the retry interceptor), GHSA-v3r7-h72x-cjcm (4.8, cookie attribute injection via an unsanitized domain and unparsed `setCookie` fields) and GHSA-m8rv-5g2x-5cg5 (4.2, CRLF injection via a blob-like body `type`). Same shape as the `brace-expansion` fix below and the `next`/`sharp` incident before it — the advisories published after the last green scan, so every branch went red at once with no dependency change of its own. `undici` is not a direct dependency; it arrives transitively under the `jsdom` test environment, and the 7.28.0 pin was itself the previous round of this fix (#446), so the repair is the same one-line `overrides` bump rather than a lockfile update. Verified with CI's own scanner image (`ghcr.io/google/osv-scanner-action:v2.3.8`) against the updated lockfile: `No issues found`, exit 0, with `osv-scanner.toml` still holding zero ignored vulnerabilities. (#650)
+- Consolidate the nine Dependabot bumps #641–#649, each of which was red on the shared `undici` finding above rather than on anything it changed. Six are npm: `posthog-node` 5.46.1 → 5.47.7 (with `@posthog/core` and `@posthog/types`), `jsdom` 30.0.0 → 30.0.1, `@tanstack/react-virtual` 3.14.8 → 3.14.9 (with `virtual-core`), `lucide-react` 1.27.0 → 1.28.0, `@types/node` 26.1.1 → 26.1.2 and `@vitejs/plugin-react` 6.0.3 → 6.0.5; the declared floors move with them so the tree cannot resolve back, and those packages plus their transitive companions are the only entries the lockfile moves. Three are Actions: `docker/login-action` 4.5.1 → 4.6.0 (SHA-pinned, as that workflow pins all of its actions), and the `actions/upload-artifact` 4 → 7 / `actions/download-artifact` 4 → 8 pair, which have to land together because `build-daemon.yml` uploads the `failproofaid-*` binaries that `publish.yml` downloads. Both are major bumps carrying a `node24` runtime, so the inputs in use were checked against each target's `action.yml` rather than assumed: `name`/`path`/`if-no-files-found` on the upload side and `pattern`/`path`/`merge-multiple` on the download side all survive, the new `archive` input defaults to `true` so the round trip still zips and unzips as before, and `translate-docs.yml` was already on v7/v8 — so this leaves the repo consistent instead of straddling two majors. (#650)
 - Bump the `brace-expansion` override from 5.0.8 to 5.0.9, clearing GHSA-rgw5-rvv9-x895 (high, CVSS 7.5) — a DoS via unbounded intermediate arrays that bypasses the CVE-2026-14257 mitigation. Because `overrides` pins the package for the whole tree, the one-line bump covers every consumer at once (`minimatch@10` under eslint/next, and the `^1.1.7` requests from the older `eslint-plugin-*` minimatches), and it is the only entry the resolved lockfile moves. Fixing rather than allow-listing, per `osv-scanner.toml`'s stated preference — the Supply Chain gate blocks on any finding, and this one had been failing since the advisory published. (#632)
 
 ## 1.0.0-beta.2 — 2026-07-31

package.json

@@ -76,19 +76,19 @@
     "@anthropic-ai/sdk": "^0.115.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
-    "@tanstack/react-virtual": "^3.14.3",
+    "@tanstack/react-virtual": "^3.14.9",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "26.1.1",
+    "@types/node": "26.1.2",
     "@types/react": "19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
+    "@vitejs/plugin-react": "^6.0.5",
     "clsx": "^2.1.1",
     "eslint": "^10.5.0",
     "eslint-config-next": "^16.2.9",
-    "jsdom": "^30.0.0",
-    "lucide-react": "^1.18.0",
+    "jsdom": "^30.0.1",
+    "lucide-react": "^1.28.0",
     "next": "^16.2.11",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
@@ -100,15 +100,15 @@
   "dependencies": {
     "html-to-image": "^1.11.13",
     "html2canvas": "^1.4.1",
-    "posthog-node": "^5.37.1",
+    "posthog-node": "^5.47.7",
     "sql.js": "^1.14.1",
     "yaml": "^2.9.0"
   },
   "overrides": {
     "postcss": "8.5.23",
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
-    "undici": "7.28.0",
+    "undici": "7.29.0",
     "brace-expansion": "5.0.9",
     "sharp": "0.35.0"
   }