Skip to content

chore: bump @fozikio/cortex-engine to ^1.3.0 - #2

Merged
idapixl merged 1 commit into
masterfrom
chore/bump-cortex-engine-1.3.0
Jul 7, 2026
Merged

chore: bump @fozikio/cortex-engine to ^1.3.0#2
idapixl merged 1 commit into
masterfrom
chore/bump-cortex-engine-1.3.0

Conversation

@idapixl

@idapixl idapixl commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Follow-up to today's security audit (action item #2): bumps the @fozikio/cortex-engine devDependency from ^1.2.0 to ^1.3.0. This is the durable fix for the recurring hono advisory cascade — 1.3.0's own dependency tree carries the patched versions, so this repo no longer needs per-week npm audit fix runs to stay clean. The peerDependencies range (>=0.1.0) already admits 1.3.0 and is unchanged.

Test plan

  • @fozikio/cortex-engine 1.3.0 installed; hono resolves to 4.12.28
  • npm audit — 0 vulnerabilities
  • npm run build passes

🤖 Generated by the weekly security audit routine.


Generated by Claude Code

Copilot AI review requested due to automatic review settings July 7, 2026 20:20

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates this package’s development tooling dependency on @fozikio/cortex-engine to incorporate the latest patched transitive dependency tree (notably resolving hono to the audited/patched version), aligning with the stated security-audit follow-up.

Changes:

  • Bumped @fozikio/cortex-engine devDependency from ^1.2.0 to ^1.3.0 in package.json.
  • Updated package-lock.json to lock @fozikio/cortex-engine@1.3.0 and resolve hono@4.12.28 in the dependency tree.
  • Minor JSON string encoding change in the description field (escape sequence for the em dash), with no semantic change.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Bumps @fozikio/cortex-engine devDependency to ^1.3.0 (peer range unchanged).
package-lock.json Locks to @fozikio/cortex-engine@1.3.0 and shows hono@4.12.28 resolved in node_modules.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Durable fix for the hono advisory cascade: 1.3.0's own lockfile carries the patched transitive tree, so consumers no longer depend on per-repo npm audit fix runs. Verified: cortex-engine 1.3.0 installed, hono resolves to 4.12.28, npm audit reports 0 vulnerabilities, build passes.
@idapixl
idapixl force-pushed the chore/bump-cortex-engine-1.3.0 branch from a98c10b to 42e002e Compare July 7, 2026 20:23
@idapixl
idapixl merged commit b24dd37 into master Jul 7, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants