[muratkeremozcan]

Updates the documentation site lockfile to http-cache-semantics@4.3.0 and refreshes the publication age cache.
Removes the temporary GHSA-ch52-4w7c-c8xp advisory exception ahead of expiry.
Any high or critical website advisory now fails the gate.

[muratkeremozcan]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: bmad-code-org/bmad-eval-quality/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b29831cb-88de-492a-8a41-7d14d2903a48

📥 Commits

Reviewing files that changed from the base of the PR and between 029890e and 6f618a7.

📒 Files selected for processing (1)

• .coderabbit.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: bmad-code-org/bmad-eval-quality/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2edeb53f-017a-41b2-97a6-ea890aae2c7c

📥 Commits

Reviewing files that changed from the base of the PR and between 1561de6 and 029890e.

⛔ Files ignored due to path filters (3)

• CHANGELOG.md is excluded by none and included by none
• lockfile-age-cache.json is excluded by none and included by none
• website/package-lock.json is excluded by !**/package-lock.json and included by website/package-lock.json

📒 Files selected for processing (4)

• .coderabbit.yaml
• .github/workflows/pr-checks.yml
• scripts/audit-website.mjs
• scripts/audit-website.test.mjs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The website audit now validates report completeness and severity totals, then fails when any high- or critical-severity advisory is present. Audit execution requires exit status zero and uses the report-only assessment API. The CLI no longer loads lockfile or site context or emits an exception warning. Tests cover clean and moderate reports, high and critical findings, malformed reports, execution status, and CLI errors. Review filters now include the audit script, its test, and the website lockfile. The licence-scan comment was updated.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 02989

The website audit allows moderate findings and rejects high or critical findings as intended. No merge-blocking issue was identified.

Pre-merge checks · 2

Passed checks (2 passed)

Check name	Status	Explanation
Title check		The title uses the conventional-commit prefix fix: and clearly describes removal of the website audit exception before expiry.
Description check		The description directly explains the lockfile update, removal of the temporary advisory exception, audit behavior, and review-scope changes.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.