Repository navigation
chore(no-release): refresh release toolchain lock - #9
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Final audit #27 / infra #31 security pass. Refresh only the npm release-toolchain lock within existing constraints: @actions/http-client 2.2.3 -> 4.0.1, nested undici 5.29.0 -> 6.29.1, removal of @fastify/busboy, and a lock regression test.
Python runtime dependencies, application code/API behavior, Kubernetes desired state and release configuration are unchanged.
Validation
Exact head 80aae57. Local: 29 pytest, mypy, Ruff, Compose config, built-image offline runtime smoke, npm ci and critical audit gate PASS. Exact-head Actions run 41065693715 PASS: test 124096360849, container 124096360721, release-toolchain 124096360268.
Fresh Python audit: 69 dependencies, zero vulnerabilities. Residual npm: ip-address moderate (one GHSA) and undici high (five GHSA), only inside npm 11.21.1 bundled by @semantic-release/npm 13.2.0. The compatible semantic-release line requires npm ^11.6.2 and no newer npm 11 fixes these; they are release-runner tooling, not FastAPI runtime.
No merge, release or deployment is authorized.