Skip to content

Codex pnpm audit fixes #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dotmh merged 2 commits into from
May 17, 2026
Merged

Codex pnpm audit fixes #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dbb72be
fix: pnpm audit issues
dotmh May 15, 2026
459284e
fix: formatting of SECURITY.md
dotmh May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,12 +25,14 @@ To help me understand and address the issue quickly, please include:
**Initial Response:** I will acknowledge receipt of your report and provide an initial assessment within **14 days**.

**Assessment Outcome:** I will inform you whether the report has been:

- **Accepted** as a valid security issue
- **Rejected** (with reasoning)

**If Rejected:** You may appeal the decision **once** by replying to my response email with additional information or clarification.

**If Accepted:** I will provide further guidance on next steps, including:

- Timeline for developing a fix
- Coordination of disclosure
- Any additional information needed
Expand All @@ -40,6 +42,7 @@ All further communication will be conducted via email replies to your original r
### Disclosure Policy

I ask that you:

- **Keep the issue confidential** until I have released a fix and published a security advisory
- **Give me reasonable time** to address the vulnerability before any public disclosure
- **Act in good faith** and avoid privacy violations, data destruction, or service disruption during your research
Expand Down
34 changes: 23 additions & 11 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,30 +23,42 @@
"author": "",
"license": "Apache-2.0",
"devDependencies": {
"@commitlint/cli": "^20.1.0",
"@commitlint/config-conventional": "^20.0.0",
"@commitlint/cli": "^21.0.1",
"@commitlint/config-conventional": "^21.0.1",
Comment on lines +26 to +27

@coderabbitai coderabbitai Bot May 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the existence of the specified package versions

echo "Checking `@commitlint/cli`@21.0.1..."
npm view `@commitlint/cli`@21.0.1 version 2>/dev/null || echo "❌ Version not found"

echo "Checking `@secretlint/secretlint-rule-preset-recommend`@13.0.2..."
npm view `@secretlint/secretlint-rule-preset-recommend`@13.0.2 version 2>/dev/null || echo "❌ Version not found"

echo "Checking secretlint@13.0.2..."
npm view secretlint@13.0.2 version 2>/dev/null || echo "❌ Version not found"

echo ""
echo "Fetching release notes for major version changes..."
echo "Commitlint v21 changes:"
gh api repos/conventional-changelog/commitlint/releases --jq '.[] | select(.tag_name | startswith("v21")) | {tag: .tag_name, url: .html_url}' | head -5

echo ""
echo "Secretlint v12 and v13 changes:"
gh api repos/secretlint/secretlint/releases --jq '.[] | select(.tag_name | startswith("v12") or startswith("v13")) | {tag: .tag_name, url: .html_url}' | head -10

Repository: dotmh/ts

Length of output: 1216

🌐 Web query:

commitlint v21 release notes changelog breaking changes

💡 Result:

Commitlint v21.0.0 was released on May 8, 2026 [1][2]. This major release includes several breaking changes and internal cleanups [1]. Breaking Changes: - Minimum Node.js version: The minimum supported Node.js version has been increased to v22 [1]. - CLI Output: The CLI now displays input from a new line [1]. A --legacy-output flag has been introduced as a transitional escape hatch to maintain previous behavior, though it is planned for removal in a future major release [1]. Users are advised to migrate their parsers and snapshots to the new format during the v21 lifecycle [1]. Other Notable Changes: - Dependency Cleanup: Significant internal refactoring was performed to leverage Node.js 22 built-ins, resulting in the removal of dependencies such as glob, fast-glob, import-meta-resolve, minimist, and fs-extra [1]. - Dependency Updates: Updated yargs to v18 and widened the cz-commitlint inquirer peer dependency to support versions 9–12 [1]. For a complete list of changes, you can view the full changelog on the official GitHub repository [1].

Citations:

🌐 Web query:

secretlint v13 v12 release notes breaking changes migration guide

💡 Result:

Secretlint v13.0.0 was released on May 4, 2026 [1]. A key change in this version is that secretlint now respects.gitignore files by default [1]. Regarding the transition from v12 to v13, users should consult the official changelog on GitHub for a comprehensive list of changes [1]. While specific, detailed migration guides are often maintained within the repository's documentation or release notes, the primary breaking change noted in recent development cycles for secretlint has been the shift toward security-focused defaults, such as making --maskSecrets the default behavior (implemented in earlier versions) [2]. To migrate or upgrade: 1. Review the full changelog between v12.3.1 and v13.0.0 on GitHub to identify any specific breaking changes affecting your configuration [1]. 2. Test your existing workflows, especially those relying on file inclusion/exclusion, as the new default behavior of respecting.gitignore may change which files are scanned [1]. 3. If you encounter issues with file scanning, you may need to adjust your configuration or CLI arguments to explicitly include or exclude files as necessary. For the most accurate and up-to-date information, always refer to the official GitHub releases page [3].

Citations:

Verify compatibility with Node.js 22 requirement and test for output format/scanning behavior changes.

Major version bumps introduce breaking changes that require testing:

  • @commitlint v21.0.1: Requires Node.js 22 minimum (increased from previous requirement). CLI output format now displays from a new line; --legacy-output flag available for backward compatibility during migration.
  • @secretlint v13.0.2: Now respects .gitignore files by default, potentially changing which files are scanned for secrets.

Verify the project's Node.js target version and test commit message linting and secret detection workflows before merging.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 26 - 27, Update release validation by confirming
Node.js target and testing linting/secret workflows: verify the project's
Node.js engine/version (ensure it meets Node.js 22+ if upgrading `@commitlint/cli`
to ^21.0.1), run commitlint CLI with current config (packages "`@commitlint/cli`"
and "`@commitlint/config-conventional`") to observe the new CLI output formatting
and test using the --legacy-output flag where needed, and run secretlint
(including v13 behavior) against the repo to confirm .gitignore is respected and
no files are unintentionally excluded; if issues appear, either pin commitlint
to a Node-compatible version, adjust package.json engines, or update CI scripts
to pass --legacy-output and update secretlint config to explicitly
include/exclude files.

"@dotmh/eslint-config-ts": "^3.0.1",
"@dotmh/prettier-config": "^2.0.0",
"@dotmh/tsconfig": "^2.1.0",
"@secretlint/secretlint-rule-preset-recommend": "^11.2.5",
"@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
"@types/node": "22.13.14",
"@typescript-eslint/eslint-plugin": "^8.48.1",
"@typescript-eslint/parser": "^8.48.1",
"@vitest/coverage-istanbul": "^4.0.15",
"eslint": "^9.39.1",
"eslint-plugin-promise": "^7.2.1",
"@typescript-eslint/eslint-plugin": "^8.59.3",
"@typescript-eslint/parser": "^8.59.3",
"@vitest/coverage-istanbul": "^4.1.6",
"eslint": "^9.39.4",
"eslint-plugin-promise": "^7.3.0",
"husky": "^9.1.7",
"prettier": "^3.7.4",
"secretlint": "^11.2.5",
"secretlint": "^13.0.2",
"tsx": "^4.21.0",
"typescript": "^5.9.3",
"vitest": "^4.0.15",
"yaml": "^2.8.2"
"vitest": "^4.1.6",
"yaml": "^2.9.0"
},
"engines": {
"node": ">=22.15.0",
"pnpm": ">=10.23.0"
},
"pnpm": {
"overrides": {
"ajv@8": "8.20.0",
"brace-expansion@1": "1.1.13",
"fast-uri": "3.1.2",
"flatted": "3.4.2",
"picomatch": "4.0.4",
"postcss": "8.5.14",
"rollup": "4.60.4",
"vite": "7.3.3"
}
},
"dependencies": {
"@dotmh/ts-base": "link:"
}
Expand Down
Loading
Loading