:rotating_light: Policy Compliance Violation — Action Required

[trimble-oss-overseer]

🚨 Policy Compliance Violation

This public repository has been found in violation of the Open and Inner Source Publication Policies and Procedures.

Findings

Severity	Category	Finding
🔴 MUST	Security	0 critical and 4 high open Dependabot vulnerabilities (must be zero)

Vulnerability details (4 alerts)

• fast-uri (high) — GHSA-4c8g-83qw-93j6 — package-lock.json
• fast-uri (high) — GHSA-v2hh-gcrm-f6hx — package-lock.json
• brace-expansion (high) — GHSA-3jxr-9vmj-r5cp — package-lock.json
• shell-quote (high) — GHSA-395f-4hp3-45gv — package-lock.json

Timeline

• Grace period: 30 days from the date of this issue
• If not resolved: This repository will be delisted (public → internal)
• Need more time? Add the delist-deferred label to this issue for a one-time 14-day extension
• If resolved after delisting: Public repromotion is not automated at this time. Once all MUST violations are cleared, contact the GitHub account administrators to request restoration to public

How to fix

Open this repo in VS Code with GitHub Copilot enabled, then run the oss-compliance reusable prompt — it will walk you through every required change.

For more details, see the oss-overseer repo and the latest audit report.

---

This issue was automatically created by oss-overseer.

[trimble-oss-overseer]

🔍 Compliance Re-check

Thanks for working on this! A re-check was triggered and found the following outstanding violations:

Severity	Category	Finding
🔴 MUST	Security	0 critical and 4 high open Dependabot vulnerabilities (must be zero)
🟡 SHOULD	Content	Missing recommended file: CODE_OF_CONDUCT.md

Vulnerability details (4 alerts)

• fast-uri (high) — GHSA-4c8g-83qw-93j6 — package-lock.json
• fast-uri (high) — GHSA-v2hh-gcrm-f6hx — package-lock.json
• brace-expansion (high) — GHSA-3jxr-9vmj-r5cp — package-lock.json
• shell-quote (high) — GHSA-395f-4hp3-45gv — package-lock.json

Please resolve the remaining items. This issue will be automatically closed once all MUST violations are cleared.

---

Re-check performed by oss-overseer.

[trimble-oss-overseer]

🔍 Compliance Re-check

Thanks for working on this! A re-check was triggered and found the following outstanding violations:

Severity	Category	Finding
🔴 MUST	Security	0 critical and 4 high open Dependabot vulnerabilities (must be zero)
🟡 SHOULD	Content	Missing recommended file: CODE_OF_CONDUCT.md

Vulnerability details (4 alerts)

• fast-uri (high) — GHSA-4c8g-83qw-93j6 — package-lock.json
• fast-uri (high) — GHSA-v2hh-gcrm-f6hx — package-lock.json
• brace-expansion (high) — GHSA-3jxr-9vmj-r5cp — package-lock.json
• shell-quote (high) — GHSA-395f-4hp3-45gv — package-lock.json

Please resolve the remaining items. This issue will be automatically closed once all MUST violations are cleared.

---

Re-check performed by oss-overseer.