Skip to content

fix: resolve npm audit findings and vite config warning - #170

Open
Munawarx wants to merge 2 commits into
CopilotKit:mainfrom
Munawarx:fix/security-audit-and-build-warnings
Open

Munawarx wants to merge 2 commits into
CopilotKit:mainfrom
Munawarx:fix/security-audit-and-build-warnings

Conversation

@Munawarx

Copy link
Copy Markdown
  • Update vulnerable dependencies within semver ranges (@modelcontextprotocol/sdk, vite, vitest, concurrently, follow-redirects, graphql-yoga, shell-quote, etc.)
  • Override katex to ^0.19.0 to clear the remaining low-severity advisories
  • Import dark-theme with .ts extension in vite.config.ts and enable allowImportingTsExtensions (disabled for the server emit config)

npm audit: 0 vulnerabilities. Format, lint, typecheck, 346 tests and build pass.

Claude-Session: https://claude.ai/code/session_01W17jrHeDwLDiGst4G1dW5c

- Update vulnerable dependencies within semver ranges (@modelcontextprotocol/sdk,
  vite, vitest, concurrently, follow-redirects, graphql-yoga, shell-quote, etc.)
- Override katex to ^0.19.0 to clear the remaining low-severity advisories
- Import dark-theme with .ts extension in vite.config.ts and enable
  allowImportingTsExtensions (disabled for the server emit config)

npm audit: 0 vulnerabilities. Format, lint, typecheck, 346 tests and build pass.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W17jrHeDwLDiGst4G1dW5c
isPublicAddress blocked whole /16s (192.0.0.0/16, 192.2.0.0/16, 198.51.0.0/16,
203.0.0.0/16) instead of the exact special-use ranges, rejecting real public
hosts. Use exact CIDRs (192.0.0.0/24, 192.0.2.0/24, 198.51.100.0/24,
203.0.113.0/24, 198.18.0.0/15) with regression tests in both directions.

Telemetry tests spawn a child process per probe; raise the vitest timeout above
the 15s child timeout to remove flakiness.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W17jrHeDwLDiGst4G1dW5c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants