mirror of
https://github.com/Hmbown/DeepSeek-TUI.git
synced 2026-09-03 06:50:13 +08:00
0dfe9170a1
Apply `npm audit fix --package-lock-only` across npm workspaces to resolve the 17 open Dependabot alerts (7 high, 10 moderate) on the v0.9.1 merged tree: - integrations/feishu-bridge: protobufjs 7.6.4 → 7.6.5 - extensions/vscode: brace-expansion 5.0.6 → 5.0.7, js-yaml 4.2.0 → 4.3.0, fast-uri 3.1.2 → 3.1.4, linkify-it 5.0.1 → 5.0.2 - web: brace-expansion/js-yaml and other transitive dev deps updated to patched versions; build, lint, tests, and `check:facts` still pass - root package-lock: refreshed transitive lockfile metadata Remaining npm audit findings: - sharp <0.35.0 (via miniflare/next/wrangler) in web and root: no non-breaking patch available; miniflare pins sharp 0.34.5. Website is not deployed for v0.9.1, so exposure is build-time only. - axios in feishu-bridge lockfile is already resolved to 1.18.1; the Dependabot alerts appear stale against the current lockfile. All affected workspace checks pass: - integrations/feishu-bridge: `npm run check && npm run test` — 19 passed - extensions/vscode: `npm run check` — compiles - web: `npm run prebuild && npm run check:facts && npm test && npm run lint && npm run build` — green Refs #4713 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>