fix(deps): close 5 high-severity advisories in the production tree by chitcommit · Pull Request #142 · chittyos/chittycommand

chitcommit · 2026-09-18T02:43:57Z

Supersedes #141 — this branch is stacked on it, so it carries that commit too. Close #141 in favour of this one.

What the gate found

npm audit --audit-level=high --omit=dev — the CI gate in ci.yml — reported 5 high-severity advisories in dependencies shipped to the Worker runtime.

These went unmeasured, not unintroduced. The gate has been unreachable on main since a60d0e1 (2026-08-07) because npm ci failed ahead of it. Three of the four advisories checked predate that commit:

Advisory	Published	vs. the 08-07 break
`GHSA-h67p-54hq-rp68` (js-yaml)	2026-06-15	before
`GHSA-28wg-ghj8-5hjv` (nanoid)	2026-07-29	before
`GHSA-5p4m-2wfm-xmqj` (js-yaml)	2026-08-06	before
`GHSA-xwg4-73v4-xw9w` (nanoid)	2026-09-01	after

The bumps — all within the existing major

Package	Change	Advisory range
`hono`	`^4.12.23` → `^4.13.8` (direct)	≤ 4.13.4
`js-yaml`	override `^4.3.2`	4.0.0 – 4.3.1
`nanoid`	override `^5.1.16`	4.0.0 – 5.1.15
`fast-uri`	override `^3.1.8`	3.0.0 – 3.1.5
`ip-address`	override `^10.7.2`	≤ 10.3.0

nanoid reached the runtime tree twice — via agents and via partyserver.

npm audit fix could not produce this: it crashes with an internal arborist error (Cannot read properties of null (reading 'edgesOut')). The lockfile was regenerated with npm install.

Verification (local, real — no mocks)

Gate	Result
`npm audit --audit-level=high --omit=dev`	exit 0 — 5 high → 0 (5 low / 2 moderate remain, below threshold)
`npm ci` from regenerated lockfile	exit 0
`tsc -p tsconfig.json --noEmit`	exit 0
`npm test`	6 passed / 1 failed — identical on the parent branch without these bumps

The one failing test, tests/workers/coordinator.test.ts, cannot resolve the cloudflare:test virtual module under the default vitest pool. Pre-existing and untouched here.

Also

Corrects ci.yml's comment claiming "the runtime dependency tree is clean" — demonstrably false, and the kind of assertion that cannot track an advisory feed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKKxbsxh4tozUMzBKADSTd

Summary by CodeRabbit

Chores
- Updated project maintenance configuration for clearer production-readiness auditing.
- Improved package compatibility and security-alignment settings.
- No user-facing features or behavioral changes were introduced.

a60d0e1 ("chore(devops): align compatibility date and upgrade agents SDK to 0.19.0") applied the Cloudflare Agents SDK version number to the wrong package. `agents@0.19.0` exists; `hono-agents` has never published a 0.19.x -- it ships on a 3.x line (currently 3.0.12). package-lock.json was never regenerated and still resolves 3.0.7, so npm ci has failed on every PR and every Workers Build since 2026-08-07: npm error notarget No matching version found for hono-agents@^0.19.0. Restores the declaration the lockfile already names, keeping the change to a single variable rather than also jumping to 3.0.12. Verified locally: npm ci succeeds (274 packages, hono-agents 3.0.7 installed) and `npm run build` (tsc --noEmit) exits clean. src/index.ts:3 imports agentsMiddleware from hono-agents, so 3.0.7 satisfies real usage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AKKxbsxh4tozUMzBKADSTd

`npm audit --audit-level=high --omit=dev` (the CI gate) reported 5 high-severity advisories in dependencies shipped to the Worker runtime. The gate has been UNREACHABLE on main since a60d0e1 (2026-08-07) because npm ci failed before it, so these went unmeasured rather than unintroduced -- three of the four advisories checked predate that commit (2026-06-15, 07-29, 08-06). Every fix stays within the existing major version; no breaking bumps: hono ^4.12.23 -> ^4.13.8 (direct; advisory <=4.13.4) js-yaml override ^4.3.2 (advisory 4.0.0-4.3.1) nanoid override ^5.1.16 (advisory 4.0.0-5.1.15) fast-uri override ^3.1.8 (advisory 3.0.0-3.1.5) ip-address override ^10.7.2 (advisory <=10.3.0) nanoid reached the runtime tree twice, via agents and partyserver. `npm audit fix` could not produce this -- it crashes with an internal arborist error ("Cannot read properties of null (reading 'edgesOut')"). The lockfile was regenerated with npm install instead. Verified locally: npm audit --audit-level=high --omit=dev exit 0 (5 high -> 0; 5 low/2 moderate remain, below gate) npm ci exit 0 tsc -p tsconfig.json --noEmit exit 0 npm test 6 passed / 1 failed -- identical on the parent branch without these bumps; tests/workers/coordinator.test.ts cannot resolve the `cloudflare:test` virtual module under the default vitest pool. Pre-existing, untouched here. Also corrects ci.yml's claim that "the runtime dependency tree is clean". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AKKxbsxh4tozUMzBKADSTd

The Dependency Audit comment asserted all High/Moderate advisories were dev-only. That went stale: the gate was unreachable from 2026-08-07 to 2026-09-18 because npm ci failed ahead of it, and when it next ran it found 5 high-severity advisories in the production tree -- three of which predated the break. A comment cannot track advisory feeds; the gate is the source of truth. Replaced with a note saying so, to stop the claim being reinstated. Note: the preceding commit's message says it corrects this comment. It did not -- the edit was blocked by a pre-commit hook and is landed here instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AKKxbsxh4tozUMzBKADSTd

chatgpt-codex-connector · 2026-09-18T02:44:03Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

coderabbitai · 2026-09-18T02:44:13Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: eb3e8eb3-7a33-4254-9d05-e0049182ff64

📥 Commits

Reviewing files that changed from the base of the PR and between f2578a3 and 2240612.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

.github/workflows/ci.yml
package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The package manifest updates hono and hono-agents, adds four dependency overrides, and retains the esbuild override. CI audit comments now describe the production dependency scope and prior audit findings.

Changes

Dependency and audit updates

Layer / File(s)	Summary
Dependency versions and overrides `package.json`	The manifest updates `hono` to `^4.13.8` and `hono-agents` to `^3.0.7`. It adds overrides for `js-yaml`, `nanoid`, `fast-uri`, and `ip-address`.
Dependency audit comment context `.github/workflows/ci.yml`	The comments describe the production dependency audit scope, reusable governance option, prior unreachable execution context, and five high-severity advisories. The audit command is unchanged.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: High

Merge Risk: ⚪ Minimal · up to 22406

The dependency declarations, resolved versions, and production audit scope are aligned, with no concrete runtime or CI failure indicated.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Issue `#141` scopes the fix to restoring the `hono-agents` declaration and its known-good resolution. The PR also upgrades `hono` to `^4.13.8`, adds overrides for `js-yaml`, `nanoid`, `fast-uri`, and `i…	Remove the unrelated advisory updates and CI comment changes from this PR, or link a separate issue that requires those changes and review them as separate scope.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating production dependencies to resolve five high-severity advisories.
Linked Issues check	✅ Passed	Issue `#141` requires `hono-agents` to use `^3.0.7` and requires CI installation to succeed. `package.json` now declares `hono-agents` as `^3.0.7`. The PR summary reports a successful `npm ci`, installe…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Out of Scope Changes check

Explanation

Issue #141 scopes the fix to restoring the hono-agents declaration and its known-good resolution. The PR also upgrades hono to ^4.13.8, adds overrides for js-yaml, nanoid, fast-uri, and ip-address, and changes CI audit comments. These changes address separate dependency advisories and have no demonstrated connection to the hono-agents installation failure.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cloudflare-workers-and-pages · 2026-09-18T02:44:35Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	chittycommand	`2240612`	Sep 18 2026, 02:44 AM

chitcommit and others added 3 commits September 18, 2026 01:41

chitcommit mentioned this pull request Sep 18, 2026

fix(test): stop the node suite collecting workerd-only tests #143

Merged

chitcommit merged commit 45bc4bc into main Sep 28, 2026
15 of 17 checks passed

chitcommit deleted the fix-prod-cves branch September 28, 2026 23:32

Navigation Menu

Repository navigation

fix(deps): close 5 high-severity advisories in the production tree - #142

fix(deps): close 5 high-severity advisories in the production tree#142
chitcommit merged 3 commits into
mainfrom
fix-prod-cves

chitcommit commented Sep 18, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Sep 18, 2026

Uh oh!

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

chitcommit commented Sep 18, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What the gate found

The bumps — all within the existing major

Verification (local, real — no mocks)

Also

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Sep 18, 2026

Uh oh!

coderabbitai Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 18, 2026

Deploying with Cloudflare Workers

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chitcommit commented Sep 18, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading