sec: patch dependency tree, drop dotenv, block install scripts
npm audit 10 -> 1: hono/qs/body-parser/@hono-node-server/fast-xml-parser fixed in-semver (MCP SDK 1.29->1.30), @anthropic-ai/sdk bumped 0.90->0.115 (advisory GHSA-p7fg-763f-g4gf), multer bumped to 2.2.0 off the 1.x LTS line. The residual is esbuild's dev-server advisory, pinned by tsx/vite ranges and unreachable here (no esbuild serve). dotenv is gone: Node >=22.13 ships process.loadEnvFile with identical no-override semantics (verified: shell wins, ENOENT guarded), loaded via a side-effect module so ESM import hoisting cannot run routers before env exists. .npmrc sets ignore-scripts=true: zero packages in this tree declare install scripts (verified via npm query), so install-time code execution - the main compromised-package vector - is now refused outright. Verified with a full clean npm ci + tsc + 709-test suite. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o
| Repository | eliziff/Beaver |
|---|---|
| Author | Eli Ziff <eliasziff@gmail.com> |
| Authored | |
| Parents | 1e6a4336 |
| Stats | 5 files changed , +145 , -144 |
| Part of | Security and dependency hardening |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-4135d954.md
from inside the repo you want the change in.