chore(deps): resolve esbuild GHSA-67mh-4wv8-2f99 via electron-vite 5 + in-range dep sweep; docs accuracy pass - #165
Merged
Conversation
9 tasks
… sweep + docs pass Weekly dependency + security sweep (Wk 3): - esbuild (Dependabot #31, GHSA-67mh-4wv8-2f99): the vulnerable esbuild@0.21.5 was pulled solely by electron-vite@2.3.0. Bump electron-vite to ^5.0.0 (Dec 2025), whose esbuild ^0.25.11 is out of the affected range (<=0.24.2). This also fixes the standing unmet-peer warning: electron-vite 5 accepts vite ^6, matching the installed vite 6.4.3. - tar ×7 (Dependabot #33-#38, #59): already resolved on main by #163 (electron-builder 26 moved the tree to tar 7.5.22 >= 7.5.16). - In-range `pnpm -r update` sweep: clears the remaining transitive audit findings (ws, js-yaml, brace-expansion, fast-uri, ip-address, nanoid, postcss). pnpm audit is down from 20 findings to 1: extract-zip <=2.0.1 (GHSA-jmr9-qjv8-65gv) has no patched release and sits in install-time tooling (electron / puppeteer downloads). - minimumReleaseAge: fast-xml-parser held at ~5.10.1 (2026-07-16); 5.11.0 is only 7 days old. All other resolved versions are 13+ days old. - Docs accuracy pass: README counts verified correct (53 agents, 12 skills, 6 plugins); no version badges exist; install entry points verified (wordpress-local.sh subcommands, flavian CLI, init wizard). Updated 5 stale "Node.js 20+" references in docs/mcp-setup.md, docs/E2E-VALIDATION.md, docs/MCP-TROUBLESHOOTING.md to 22.12+ (baseline raised in #163). Closes #158 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
PAMulligan
force-pushed
the
158-choredeps-weekly-dependency-security-sweep-wk-3-8-dependabot-alerts-tar-7-esbuild-docs-pass
branch
from
August 24, 2026 02:20
f283600 to
e20e38a
Compare
The gui job installs with ELECTRON_SKIP_BINARY_DOWNLOAD=1, and pnpm's side-effects cache recorded that empty postinstall into the store. The store is cached keyed on the lockfile, so once the (faster) gui job saved the cache, the smoke job restored an electron without dist/ and failed with "Electron failed to install correctly". - gui job: disable the side-effects cache for the skip-binary install so the poisoned artifact never enters the shared store cache. - smoke job: self-heal — if electron's path.txt/dist are missing after install, run its install script directly (also repairs the cache entry already saved for the current lockfile key). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ep-wk-3-8-dependabot-alerts-tar-7-esbuild-docs-pass
PAMulligan
deleted the
158-choredeps-weekly-dependency-security-sweep-wk-3-8-dependabot-alerts-tar-7-esbuild-docs-pass
branch
August 24, 2026 02:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly Dependency + Security Sweep (Wk 3) — closes #158.
Dependabot alerts (8)
tar ×7 (#33–#38, #59) — already resolved on
mainby #163: electron-builder 26 moved the whole chain to a singletar@7.5.22, past the 7.5.16 fully-fixed floor for this cluster. No further action needed; the alerts should auto-dismiss on Dependabot's next scan.esbuild #31 (GHSA-67mh-4wv8-2f99, Moderate) — the vulnerable
esbuild@0.21.5was pulled solely byelectron-vite@2.3.0. Bumpedelectron-viteto^5.0.0(published 2025-12-07, well past cooldown), whoseesbuild ^0.25.11resolves 0.25.12 — outside the affected range (≤0.24.2). Bonus: electron-vite 5 accepts vite ^6, which fixes the long-standingunmet peer vite@"^4.0.0 || ^5.0.0": found 6.4.3install warning. The GUI's minimal conventional-layout config needed no changes.In-range dependency sweep
pnpm -r update(no majors) cleared the rest of the transitive audit findings — ws, js-yaml, brace-expansion, fast-uri, ip-address, nanoid, postcss.pnpm auditwent from 20 findings to 1; the survivor isextract-zip ≤2.0.1(GHSA-jmr9-qjv8-65gv), which has no patched release (patched range<0.0.0) and lives in install-time tooling (electron / puppeteer browser downloads) — nothing bumpable.minimumReleaseAge honored:
fast-xml-parserheld at~5.10.1(2026-07-16) because 5.11.0 is only 7 days old; every other resolved version is 13+ days old (spot-checked publish dates).Docs accuracy pass
.claude/agents/), 12 skills (12 dirs in.claude/skills/), 6 plugins (6 listed). All accurate, no changes needed.pnpm install(clean, no peer warnings now),wordpress-local.shexists with the documentedbuild/start/install/activate-themesubcommands,node bin/flavian.mjs --helpandnode scripts/init.mjs --helpboth run. Prereqs table already shows Node 22.12+ / pnpm 9.x correctly.docs/mcp-setup.md,docs/E2E-VALIDATION.md,docs/MCP-TROUBLESHOOTING.md.Dependabot / Dependency graph remains enabled.
Test plan
pnpm gui:build/gui:test(53/53) /gui:typecheck/gui:lint— all pass under electron-vite 5pnpm test:pipeline— 133/133 pass (incl. with fast-xml-parser held at 5.10.1)pnpm audit— 1 finding remaining (unpatchable extract-zip), down from 20Notes:
pnpm test:initand the GUI Playwright smoke fail identically onmainin this environment (local mawk/gawk incompatibility; no display for Electron) — both unrelated, and the smoke is covered by the CIsmokejob.🤖 Generated with Claude Code