[paustint]

Summary

Clears the npm audit findings that upstream pins were holding open, in both the root package and the docs site, using npm overrides. No changes to the published library.

Root (package.json)

Finding	Cause	Fix
basic-ftp <=6.2.0 (GHSA-c475-qrg2-pj4r)	get-uri (release-it → proxy-agent → pac-proxy-agent → get-uri) pins basic-ftp@^5	override basic-ftp to ^6.2.1 under get-uri

npm audit → 0 vulnerabilities (was 6 high). The only 6.0 breaking change is that separate FTP transfer hosts are off by default, which get-uri never opts into. npm audit fix --force would have downgraded release-it to 15.10.3, which is not a real fix.

Docs (docs/package.json)

Finding	Cause	Fix
minimatch 9.0.0–9.0.6 (3 ReDoS advisories)	docusaurus-plugin-llms pins 9.0.3 exactly	^9.0.7 scoped under the plugin
yaml <2.8.3	docusaurus-plugin-llms pins 2.8.1 exactly	^2.8.3 scoped under the plugin
sprintf-js <=1.1.3 (no patched release)	gray-matter → js-yaml 3 → argparse@1 → sprintf-js	argparse ^2.0.1; js-yaml 3 only uses argparse in its CLI, and js-yaml 4 already wants ^2.0.1, so sprintf-js leaves the tree
uuid <11.1.1	sockjs (webpack-dev-server) wants ^8.3.2	^11.1.1 scoped under sockjs; it only calls v4()
postcss-selector-parser <7.1.6	cssnano 6 plugins want ^6	^7.1.6 top-level (7.0.0's only change is safe insertion during iteration)
serialize-javascript <=7.0.4 (RCE + DoS)	copy-webpack-plugin / css-minimizer-webpack-plugin want ^6	^7.0.5 top-level (7.0.0 only raised Node to 20+)
tinypool <=2.1.1 (prototype pollution → RCE)	@docusaurus/core wants ^1.0.2	^2.1.2 top-level (2.0.0 only dropped Node 18; Docusaurus loads it via dynamic import(), so ESM-only is fine)

npm audit → 29 high, all one advisory (was 52: 15 critical, 17 high, 20 moderate). Everything left traces back to braces GHSA-vfj7-8cjw-p6xm, whose vulnerable range is <=3.0.3 and whose latest release is 3.0.3, so there is nothing to override to yet.

A nested "gray-matter": { "argparse": ... } override did not apply to the grandchild under npm 11.19, so that one is top-level. This and the "overrides are temporary, drop them when upstream catches up" guidance are recorded in a new Dependency overrides section of AGENTS.md.

Verification

• Root: npm run typecheck, npm run build, npm test (2361 passing), npx release-it --version, and get-uri imports basic-ftp 6.2.3 cleanly
• Docs: npm run typecheck and npm run build (Docusaurus production build + CSP headers), with gray-matter loading js-yaml 3 without argparse
• npm run format:check and npm run lint clean
• npm run release:increment → Changed -> patch

[Copilot]

🟡 Changes recommended

The docs lockfile removes serve-handler’s required minimatch version, leaving an inconsistent dependency graph.

1 open finding

• Preserve serve-handler's minimatch 3.1.5 lockfile dependency · New

What changed in this PR

Adds temporary dependency overrides to address audit findings in development tooling and the docs site without changing published library code.

Changes:

• Adds overrides and refreshes both lockfiles.
• Records the audit improvements and remaining vulnerability.
• Documents override maintenance guidance.

File	Description
package.json	Overrides get-uri’s basic-ftp dependency.
package-lock.json	Locks the updated FTP dependency.
docs/​package.json	Adds docs dependency overrides.
docs/​package-lock.json	Updates and deduplicates overridden dependencies.
CHANGELOG.md	Records audit remediation and remaining findings.
AGENTS.md	Documents override scope and removal guidance.

Files not reviewed (1)

• docs/package-lock.json: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[paustint]

Good catch, and it was worse than a lockfile inconsistency: serve-handler calls require('minimatch') as a function, and minimatch 9's CJS entry exports an object, so docusaurus serve would have thrown on its rewrite path. The nested override leaked because once the overridden copy is hoisted, npm dedupes other dependents onto it too (reproducible with a fresh --package-lock-only resolve, not just the incremental install).

Fixed in 8ebea36 by keying every override on the range the dependent asks for ("minimatch@9": "^9.0.7", "yaml@2", "uuid@8", "basic-ftp@5") instead of nesting under a parent. A keyed rule only matches edges whose requested range intersects the key, so serve-handler/node_modules/minimatch@3.1.5 is back in the lockfile and npm ls minimatch shows serve-handler on 3.1.5 and docusaurus-plugin-llms on 9.0.9. Audit results are unchanged (root 0, docs 29 from braces).

Verified: clean npm ci from the lockfile in a scratch directory (lockfile byte-identical afterwards, no invalid/missing nodes), docs production build, and a docusaurus serve smoke test returning 200 for /, /docs/api and /llms.txt. AGENTS.md guidance updated to say the same.

[Copilot]

🔵 Needs a closer look

Several overrides cross major versions and warrant human confirmation of tooling compatibility beyond the reported build and smoke checks.

1 open finding

• Preserve serve-handler's minimatch 3.1.5 lockfile dependency

Files not reviewed (1)

• docs/package-lock.json: Generated file

🧠 Review effort: Balanced