Skip to content

docs: record upstream release limits #240

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tonyketcham merged 1 commit into from
Aug 12, 2026
+15 −0
Merged

docs: record upstream release limits #240

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,21 @@ Three reach npm for the first time in this release:
`tonyketcham/flatbread` fork.
- Every package carries a description that says what that package does.

### Known dependency limits

A clean install of all twelve packages reports seven `npm audit` entries that
npm marks as having no fix available; the main `flatbread` install and its
nine-package set report none, so the two packages below do not affect it.
Comment on lines +64 to +66

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MED (consensus) — “nine-package set” collides with the earlier “Nine were already on npm as alphas” list (a different nine that includes resolver-svimg and excludes effort-graph / explorer). Readers may think the alpha cohort is the clean flatbread install path.

LOW — “A clean install of all twelve packages” also underspecifies how to reproduce the seven-entry audit (peer svimg is required for the sharp chain).

Minimal fix: Rename to something explicit such as “flatbread’s nine @flatbread/* runtime dependencies,” and add a short repro qualifier (install all twelve 1.0.0 packages with svimg@3, then npm audit).

Comment on lines +64 to +66

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH — “its nine-package set” can be read as the nine alpha packages listed earlier in this file (lines 14–19), which includes @flatbread/resolver-svimg. That invites a false clean-audit reading for resolver consumers.

Minimal fix: say “flatbread’s nine direct @flatbread/* dependencies” (or enumerate codegen/config/core/effort-graph/explorer/source-filesystem/transformer-markdown/transformer-yaml/utils). Also clarify that the twelve-package / seven-entry figure assumes optional @flatbread/proof and @flatbread/resolver-svimg (with svimg) are present.


- `@flatbread/proof` inherits three moderate and high entries from
`@cursor/sdk`, which depends on `@connectrpc/connect-node@1.x` and through it
`undici@5.x`. No current or later `@cursor/sdk` release clears them, and the
later releases require Node 22.13 or newer.
Comment on lines +68 to +71

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MED (consensus) — “three moderate and high entries” is grammatically ambiguous and does not match a clear severity split readers will see in npm audit for @flatbread/proof.

Minimal fix: Rewrite to an explicit split — prefer “three moderate and one high” / “four entries: three moderate, one high” (including the @flatbread/proof rollup), unless you intentionally exclude the package mirror.

Comment on lines +68 to +71

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MED — “inherits three moderate and high entries” reads as three total and undercounts a proof-only packed install (four entries: three moderate, one high — proof / @cursor/sdk / @connectrpc/connect-node / undici).

Minimal fix: spell out “three moderate and one high” (or “four entries: three moderate, one high”) so the 4+3=7 split stays auditable.

- `@flatbread/resolver-svimg` inherits four high entries from its required peer
`svimg`, which depends on `sharp`. The latest `svimg@4` still pins `sharp`
below the patched 0.35 line, and it changes the import API this resolver
uses.
Comment on lines +72 to +75

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH (consensus) — This bullet says @flatbread/resolver-svimg inherits four high npm audit entries from svimg→sharp. A clean audit on the resolver + svimg@3 chain reports three high (@flatbread/resolver-svimg, svimg, sharp). The fourth high in the release’s seven-entry total is undici on the proof/@cursor/sdk chain, so this over-attributes and will not match a naïve audit rerun.

Minimal fix: Change “four high entries” to “three high entries” (optionally note they are three of the release’s four highs).

Comment on lines +72 to +75

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH — “inherits four high entries” does not match a packed install of @flatbread/resolver-svimg + peer svimg@3.x, which reports three high (@flatbread/resolver-svimg, svimg, sharp).

Minimal fix: change “four” → “three”. Keep the svimg@4 / sharp-below-0.35 / import-API rationale (that part checks out).


### Docs

- The READMEs and `docs/positioning.md` now lead with the Effort Graph: an
Expand Down
Loading