Repository navigation
chore(deps-dev): fix high-severity brace-expansion audit failure - #21
Merged
Merged
Conversation
Bumps transitive brace-expansion 5.0.9 -> 5.0.12 via npm audit fix (chain: eslint -> minimatch -> brace-expansion). Unblocks the npm audit gate failing on CI.
7 of 8 tasks
TheStreamCode
added a commit
that referenced
this pull request
Oct 14, 2026
…22) ## Summary Discovery-only catalog: the built-in catalog ships provider endpoints only, and model lists always come from live GET /models — no shipped lists to go stale. The catalog is also pruned to coding-oriented frontier providers. Stacked on #21 (audit fix): merge #21 first, then rebase this branch. ## Changes - Removed all shipped model lists; fallback chain is now remembered list -> pinned models -> provider omitted with a logged reason - Ranking no longer prefers any model family (recency, version, context, name) - Vision flag is read from live provider metadata, like reasoning already was - Added muse (Meta Muse) and im (NVIDIA NIM) providers - Removed stepfun, doubao, hunyuan, qianfan (**breaking**: configs referencing these ids need updating) - catalog:update is offline (no models.dev fetch); catalog:audit checks each provider serves a usable chat model - --no-discovery is now an offline mode (pinned or remembered lists, no network) - --list-providers shows key state and pinned/remembered counts - New provider key envs registered in DEFAULT_SECRET_SOURCE_ENV and covered by tests - Docs: README, provider-verification (re-probed 2026-10-14), troubleshooting, AGENTS.md, CHANGELOG, example config ## Testing - [x] pm run lint && npm test passes (183 pass, 0 fail, 2 skipped; was 178/0/2) - [x] Tested on Windows - [ ] Tested on macOS / Linux (covered by the CI matrix) - [x] Verified with real providers: catalog:audit live (7 keyless catalogs resolve, incl. NIM 80/69 and OpenRouter 462/447); end-to-end discovery+picker smoke against NIM (ids-only defaults) and OpenRouter (real limits + vision flag) - [x] pm pack --dry-run shows only shipped paths; both pm audit gates clean ## Checklist - [x] PR is focused on a single concern - [x] README.md updated if user-facing behavior changed - [x] No API keys or credentials in code or examples - [x] New provider entries document the base URL, model behavior, and authentication requirements - [x] Credential environment names are registered and tested when authentication is required ## Notes - muse/ im endpoints verified by probe (401 on invalid key) plus official docs (Context7: Tencent/NVIDIA/Perplexity lookups during review; Meta has no indexed API docs, so Muse rests on probes + convergent third-party reports). No-key end-to-end inference run yet — keys needed. - Perplexity, Baichuan, Baseten evaluated and deliberately not shipped
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the failing
pm audit gate on CI. The full-tree audit (
pm audit --audit-level=high) fails with 1 high-severity advisory on transitive �race-expansion 5.0.9 (GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p), reached via eslint -> minimatch -> brace-expansion.
Unblocks #19 and #20, which fail on the same gate for the same pre-existing reason.
Changes
pm audit fix (3 lines, no package.json change, no runtime code touched)
Testing
pm run lint && npm test passes (178 pass, 0 fail, 2 skipped)
pm audit --audit-level=high and
pm audit --omit=dev --audit-level=high both report 0 vulnerabilities
Checklist
Notes