Repository navigation
chore(deps): clear the moderate npm audit advisories (vitest 4.1.12, fast-uri, ip-address) #2814
Description
Found by the npm audit report at v2.13.0 release prep (#2812). All are moderate, so they fall below the release's --audit-level=high bar. They are recorded here rather than left to resurface at the next release.
| Package | Install(s) | Advisory | Notes |
|---|---|---|---|
vitest, @vitest/mocker, @vitest/coverage-v8, @vitest/browser(-playwright), @storybook/addon-vitest |
root, clients/web |
GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp | Patched in 4.1.12. This is the four-edit vitest bump from AGENTS.md: the exact pins on vitest, @vitest/coverage-v8 and web's @vitest/browser-playwright, plus web's vitest overrides entry (#2301). |
fast-uri |
root | GHSA-w74x-v6f9-j3xg, -xhq7-xmqj-769h, -wjr9-j795-jxcr, -333x-w4r6-6crp | Transitive (ajv). Check for an in-range npm update; otherwise an overrides entry. |
ip-address |
root | GHSA-rxp7-6hxx-x8q5 | Transitive. Same approach. |
Never npm audit fix (#2058). Each fix is deliberate: a direct bump or an overrides entry, gated by npm run local:gate.
Activity
cliffhall commentedon Oct 28, 2026
Scope update:
fast-urimoved out of this issue into #2820 and ships in v2.13.0, because it is the only one of these that reaches the published package (viaajv). This issue now covers the vitest 4.1.12 four-edit bump andip-address, both dev-only.cliffhall commentedon Oct 29, 2026
Fixed by #2852, merged into
v2/main; verified together with the rest of v2.14.0 in the rollup #2858.