fix(package-vulnerability-scanner): clear the Vite scaffold leftovers, fix deps - #461
Draft
amylin1249 wants to merge 2 commits into
Draft
fix(package-vulnerability-scanner): clear the Vite scaffold leftovers, fix deps#461amylin1249 wants to merge 2 commits into
amylin1249 wants to merge 2 commits into
Conversation
This was referenced Jul 29, 2026
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
from
July 29, 2026 17:50
800e46f to
5e0fe98
Compare
Contributor
Extension release summary😴 Changed but won't releaseThe following extensions have code changes but the manifest version hasn't been incremented:
If you intended to release these changes, update the See the contributing guide for details. |
amylin1249
marked this pull request as draft
July 31, 2026 15:43
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
from
August 1, 2026 01:33
5e0fe98 to
1e39795
Compare
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
from
August 1, 2026 01:51
1e39795 to
4b81f1c
Compare
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
2 times, most recently
from
August 1, 2026 04:58
af54532 to
4edf108
Compare
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
from
August 1, 2026 05:27
4edf108 to
b6698c9
Compare
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
from
August 1, 2026 05:46
b6698c9 to
5ce5549
Compare
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
2 times, most recently
from
August 1, 2026 16:02
4a6a9ce to
c559798
Compare
…, fix deps Set the browser tab title to "Package Vulnerability Scanner" and remove the leftover Vite scaffold favicon reference (/vite.svg), which 404'd because the file isn't part of the bundle. Set rel="noopener" on the Package Manager footer link, which opens in a new tab with no rel at all, so the linked page can't reach back into this app through window.opener. npm audit fix resolves the markdown-it (ReDoS) and postcss/vite advisories within their existing semver ranges. The one remaining high-severity advisory (brace-expansion, via @vue/test-utils' own dependency chain) has no non-breaking fix available upstream; it's dev-only tooling that never ships in the deployed app.
…oors to pyproject requirements.txt named three of its four dependencies with no version at all, so a deploy could resolve a fastapi or posit-sdk older than the code expects. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
amylin1249
force-pushed
the
pvs-09-security-and-misc
branch
from
August 1, 2026 16:38
c559798 to
2ce2a51
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split out of #428 into small, reviewable PRs (tracking issue #415). Stacked 9/10 — stacked on #460, merge bottom-up.
Sets the browser tab title and removes the leftover Vite favicon reference, adds
rel="noopener"to the Package Manager footer link, and updates frontend dependencies to clear the npm audit advisories.npm auditon this branch now reports 0 vulnerabilities, with and without--omit=dev. For reference,mainreports 4 (1 moderate, 3 high): the markdown-it ReDoS, linkify-it, postcss XSS, and vite.pip-auditonrequirements.txtis also clean.requirements.txtpreviously named three of its four dependencies with no version at all, so a deploy could resolve afastapiorposit-sdkolder than the code expects. Floors now matchpyproject.toml. These are deliberately floors rather than exact pins: pinning would freeze the set until someone bumps it, which is the wrong default for a vulnerability scanner. The file also stays hand-written rather than auv export, sincepyprojectdeclaresfastapi[standard]and exporting would bundle uvicorn/watchfiles/fastapi-cli into content that Connect already serves.