From 9fd03f461b643f7f85dbbc2459269d2d24fcae46 Mon Sep 17 00:00:00 2001 From: homen Date: Thu, 8 Oct 2026 04:43:01 -0700 Subject: [PATCH] fix(deps): patch vulnerable transitive dependencies --- HANDOFF.md | 8 ++++++++ package-lock.json | 12 ++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/HANDOFF.md b/HANDOFF.md index cfcb961..d58c50f 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -92,3 +92,11 @@ adds no new capture, render, provider, production or visual-quality certificatio The no-key bridge's named proof is `CURRENT-GATES-RETAINED-EVIDENCE-OBSERVED-DRIFT-REJECTED-01`. Unchanged main passed 43 parses, 36 tour assertions, 34 prose citations and three render records. The candidate passed 45 parses (two protocol files added), the same 36/34/3 assertions and 20 local scenarios with no failures or skips. The preserved old 13-scenario suite had passed while labelling a schema-only receipt verified; the corrected scenario returns observed, including failed and unbound references. These are different suites, not a speed comparison. The actual projection contains three observed historical assets and zero workflow receipt references, with not-certified/releaseReady false. Stale proof did not rewrite outputs; redirected directory/file outputs were rejected with foreign files unchanged; eight repeated rounds and two simultaneous disjoint fixture jobs passed. The [bridge update log](docs/NODEKIT_PRESENT_EVIDENCE.md) records the source/claim boundaries and preserved Windows launcher failure. No capture/render, provider, production, physical-device or pixel result was added by this work. + +## Transitive dependency audit update (2026-10-08) + +A developer using the retained Remotion 4.0.479 toolchain can install the patched lock without changing its top-level dependency versions or parent ranges. The pre-update lock audit reported one moderate [fast-uri advisory](https://github.com/advisories/GHSA-hrr3-gc8f-f4qj) and one high [source-map-js advisory](https://github.com/advisories/GHSA-68fv-2mgg-jv7q). The normal `npm update fast-uri source-map-js --package-lock-only` changed fast-uri 3.1.7 to 3.1.8 and source-map-js 1.2.1 to 1.2.2. Only their version, registry URL and integrity fields changed; the 233 lock entries and all other dependency records stayed the same. + +Named local proof `FEATURECLIP-TWO-TRANSITIVE-AUDIT-FIXES-01` passed: the new `npm audit --package-lock-only --json` returned zero findings, and `npm run check` passed 45 source parses, 36 tour assertions, 34 prose citations, three render-record byte bindings and all 20 existing scenarios with no failures or skips. The evidence proof still reports three observed historical assets, zero workflow receipt references and `releaseReady: false`. + +This run updated the lock only; it did not install dependencies, capture or render media, or certify security, pixels or release readiness. Remote CI, a fresh installed-tree audit and render compatibility remain pending at this proof capture time. The earlier dated output and audit results above remain historical. diff --git a/package-lock.json b/package-lock.json index a11437d..90b17ee 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1833,9 +1833,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", + "version": "3.1.8", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", + "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", "funding": [ { "type": "github", @@ -2575,9 +2575,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0"