fix(deps): clear routing and transitive audit findings - #108
Merged
Conversation
devswha
added a commit
that referenced
this pull request
Sep 4, 2026
The docs still described SSH enrollment as manual-only after Fleet RFC revision 4 and #101 shipped managed tunnels. Other contributor-facing instructions omitted the shipped omo provider and still called for hand-written release notes. Align the roadmap, README, installation, operations, contribution, provider and upstream-intake guides with existing behavior and contracts. Keep the manual-forward option, document easy setup's remote installation/port 3001 requirements and key/password/host-key behavior, correct backend paths, and preserve canonical GitHub-generated release notes. Add a dated maintenance review recording the open issue/PR inventory, reproduced verification and dependency findings, remaining P3 work, Herdr/relay prerequisites, and verification limits. This report does not replace the roadmap or widen normative contracts. Validation: checked 78 relative file links and documented npm script references across 30 documentation files; checked changed section anchors; `node scripts/check-identity.mjs` and `git diff --check` passed. Code changes have separate PRs (#107 and #108) and verification evidence. The browser runtime had no connected browser, so no extra browser or release-grade CUA claim is made.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v1.8.18 dependency graph reports seven npm audit findings (six moderate, one low) across query parsing, routing, and build tooling. This change brings
npm auditto zero findings without weakening the audit gate.react-router-domfrom 6.30.4 to 7.18.3, covering the navigation/SSR advisories and the later RSC CSRF fix. Keep the supported compatibility imports; the app uses React 18, declarative BrowserRouter, absolute routes, and module-scoped lazy components. Reviewed the official v6-to-v7 migration guide and published advisories.qsto ^6.16.0 because Express 4 and body-parser still constrain it to ~6.15.1. Remove the override when those dependency ranges accept a safe version.@humanfs/nodeto 0.16.8 and the affected selector-parser copies to 6.1.4, with their required transitive updates. No unrelated direct SDK updates or product version change.Validation:
npm auditreports zero vulnerabilities; the existing Express-resolved qs reproducer throws before the update and succeeds after it; 43 focused mounted routing/session tests pass.npm run verifypassed on Node 24.18.0 with 1,449 server tests, 48 real tmux/PTY tests, 525 client tests, and 29 Rust tests; zero skips or failures. Type checks, lint, identity and production build passed.npm lsconfirms the intended versions throughout the graph. Release-grade CUA was not run.