The 11 remaining open Dependabot alerts (#58–#64, #70–#73) are all against undici@5.28.4, which is pinned exactly by psychds-validator@1.5.1 — a runtime dependency of @jspsych/metadata-cli. They cannot be fixed in this repo:
- Most advisories have no patched 5.x release.
- npm
overrides against an exact pin corrupt tree resolution (verified during triage), and would not protect published CLI users anyway.
Upstream fix requested: psych-ds/psychds-validator#112
When a fixed psychds-validator ships: bump it in packages/cli/package.json, run the CLI e2e suite (it exercises the validator end to end), and the 11 alerts should auto-resolve on the next Dependabot scan.
Risk while open: low — undici is used only for the validator's HTTPS schema fetches to fixed URLs; the high-severity advisories are WebSocket-specific vectors the validator does not use.
Context: triage in #140 (fixed 18 of 32 alerts; 3 dismissed with reasons — vue-template-compiler #5 as not-used, tmp #20/#57 as tolerable risk).
🤖 Generated with Claude Code
The 11 remaining open Dependabot alerts (#58–#64, #70–#73) are all against
undici@5.28.4, which is pinned exactly bypsychds-validator@1.5.1— a runtime dependency of@jspsych/metadata-cli. They cannot be fixed in this repo:overridesagainst an exact pin corrupt tree resolution (verified during triage), and would not protect published CLI users anyway.Upstream fix requested: psych-ds/psychds-validator#112
When a fixed psychds-validator ships: bump it in
packages/cli/package.json, run the CLI e2e suite (it exercises the validator end to end), and the 11 alerts should auto-resolve on the next Dependabot scan.Risk while open: low — undici is used only for the validator's HTTPS schema fetches to fixed URLs; the high-severity advisories are WebSocket-specific vectors the validator does not use.
Context: triage in #140 (fixed 18 of 32 alerts; 3 dismissed with reasons — vue-template-compiler #5 as not-used, tmp #20/#57 as tolerable risk).
🤖 Generated with Claude Code