fix(deps): bump js-yaml and markdown-it to clear osv-scanner advisories - #23
Merged
Conversation
The advisory osv-scanner lane (PR #22) surfaced two medium dev-dependency vulnerabilities, both transitive under markdownlint-cli2@0.22.1, which pins them to exact versions: - js-yaml 4.1.1 -> 4.2.0 (GHSA-h67p-54hq-rp68) - markdown-it 14.1.1 -> 14.2.0 (GHSA-6v5v-wf23-fmfq) Because the parent pins exact versions, force the patched floors with a scoped npm override (the standard mechanism for a transitive security bump without waiting on the upstream release). Both are minor, semver-compatible bumps. Verified: npm audit and osv-scanner both report 0 vulnerabilities; the markdown module fixtures test still passes, so markdownlint-cli2 behavior is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 tasks
kyle-sexton
added a commit
that referenced
this pull request
Jul 15, 2026
… style (#124) ## Summary Codifies six open decisions from the org's issue/PR consistency assessment into `conventions/process/issue-tracker.md`: - **#9** `entities-governance-doc-topology-reference-style` — abstracts the personal-vs-org repo-topology prose (no more named `melodic-software/github-iac` / `kyle-sexton/github-iac` links); points at `github-iac`'s `GovernedRepositories.cs` as the sole source of truth for which repositories are governed and how. - **#23** `entities-closing-keyword-house-style-convention` — codifies native GitHub closing keywords (`Closes`/`Fixes`/`Resolves` `#N`) as the default house style, with `provisioning`'s stricter requirement (native keyword plus a manual `## Related` section, per decisions #58/#59) as the one named exception. - **#25** `naming-issue-title-vocabulary-governance` — codifies issue titles as free text with no enforced prefix vocabulary (no `[CC]`-style conventional-commit tags), documenting the existing silence as a deliberate choice. - **#45** `entities-assignee-claiming-guidance-relevance` — keeps the existing assignee-plus-lease claiming guidance but marks it explicitly deferred, with an activation trigger (required reviewers / multi-maintainer assignment contention). - **#48** `metadata-codeowners-adoption` — adds a one-line note that CODEOWNERS adoption is deferred, contingent on decision #11 (`required_approving_review_count` staying at 0 org-wide) — CODEOWNERS is inert without required reviews. - **#49** `comments-codify-human-conventions` — codifies three optional documented conventions: a 🤖 footer marking bot-authored comments, citing evidence when closing on it, and a 🔒 marker for claimed issues (explicitly framed as the lightweight interim signal until #45's mechanism activates). Decisions Log: https://claude.ai/code/artifact/232ecdce-8316-4880-8c0a-dc3c7dcf3a63 ## Test plan - [x] `lefthook run pre-commit` — typos, editorconfig, gitleaks, markdownlint all pass - [x] Grepped the file for residual `kyle-sexton`/named `github-iac` repo references — none remain - [ ] Human review of tone/placement against the rest of the process conventions 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the two medium dev-dependency advisories the new
osv-scannerlane (#22) surfaced. Both are transitive undermarkdownlint-cli2@0.22.1, which pins them to exact versions:js-yaml4.1.1 → 4.2.0 (GHSA-h67p-54hq-rp68)markdown-it14.1.1 → 14.2.0 (GHSA-6v5v-wf23-fmfq)Because the parent pins exact versions (so
npm updatecan't move them), I force the patched floors with a scoped npmoverride— the standard mechanism for a transitive security bump without waiting on the upstream release. Both are minor, semver-compatible bumps; onlypackage.json+package-lock.jsonchange.Verification
npm audit→ 0 vulnerabilities;osv-scanner -r ./→ No issues found (exit 0).🤖 Generated with Claude Code