fix(FFESUPPORT-891): re-resolve axios + brace-expansion to patched versions (Vanta 2026-07)#421
Conversation
…rsions Vanta/Dependabot supplement (2026-07). Re-resolve two transitive dev-tooling deps in the root package-lock.json to versions outside their vulnerable ranges: axios 1.16.1 -> 1.18.1 (GHSA-gcfj-64vw-6mp9 + 9 others, < 1.18.0) and brace-expansion 1.1.14 -> 1.1.16 (GHSA-3jxr-9vmj-r5cp, < 1.1.16). axios is pulled transitively by wait-on (via start-server-and-test), within its declared ^1.6.1 range; brace-expansion is a deep transitive. Lockfile-only; no package.json, no shipped SDK crate/package, no changeset needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
🤖 Context from Claude: Final independent review via the local codex CLI (read-only) — no blocking issues found. codex confirmed: axios → 1.18.1 and brace-expansion → 1.1.16 (both meet the required floors); exactly six changed fields (version/URL/integrity for each); |
🤖 Generated from Claude
Resolves the July 2026 Vanta/Dependabot supplement for eppo-multiplatform — FFESUPPORT-891.
What & why
After the prior July sweep (#420), two advisories remained, both transitive dev-tooling deps in the root
package-lock.json(the monorepo's test-orchestration tooling —start-server-and-test→wait-on). Nothing ships in any SDK crate/package.< 1.18.0)< 1.1.16)Fix is a lockfile-only re-resolution (
npm update axios brace-expansion). axios resolves withinwait-on's declared^1.6.1; brace-expansion is a deep transitive. Nopackage.jsonchange, no override.Why no changeset
This touches only root dev-tooling in
package-lock.json— no published package (eppo_core,python-sdk,ruby-sdk,elixir-sdk,rust-sdk) changes, so there is nothing to version/release. ThePrepare releaseworkflow runs only on push tomainand gates on shipped-package changes.How tests/CI protect this change
npm installis clean and idempotent,npm auditreports 0 vulnerabilities, and the tooling (wait-on,start-server-and-test) loads correctly with axios 1.18.1. CI'snpm run testuses exactly this tooling to spin up the mock-server and run the Rust/Python/Ruby/Elixir suites — a working test run is the safety net.Deferred / out of scope
None — these were the only open advisories for this repo.