fix(deps): clear Dependabot vulnerability (fast-uri)

[tonychang04]

What

Clears the open Dependabot vulnerability (fast-uri) in this repo.

Why

Vanta flags open package vulnerabilities past SLA. This was the last remaining alert in this repo.

How - the safe way

The finding was transitive (fast-uri), resolved by a plain npm audit fix:

• no --force - semver-compatible only, no major bumps
• package.json untouched - only package-lock.json changes

npm audit now reports 0 vulnerabilities.

Verified

npm run compile succeeds - esbuild produced out/extension.js at 345.7kb, no errors.

Generated with Claude Code

https://claude.ai/code/session_01Wcz88SBYF2DgQ7dTvTqjep

---

Summary by cubic

Remediates the transitive fast-uri vulnerability via a non-force npm audit fix, updating package-lock.json only. Clears the final Dependabot/Vanta alert with no expected runtime behavior change.

• Updates: fast-uri 4.1.1 → 4.1.2 (dev), brace-expansion 5.0.7 → 5.0.9.
• Note: brace-expansion now declares engines Node 20+ (drops Node 18). If you develop on Node 18, upgrade to Node 20+.
• No changes to package.json; no major bumps; no --force.
• Verified: npm run compile succeeds; npm audit reports 0 vulnerabilities.

^{Written for commit 188b600. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 38abd0cd-d0c0-460e-b653-7523c07476f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[jwfing]

Review: fix(deps): clear Dependabot vulnerability (fast-uri)

Summary: A clean, minimal, lock-file-only remediation that bumps two transitive dev dependencies to their patched releases; no runtime code changes, low risk.

Requirements context

No /docs/superpowers/ (or any spec/plan) directory exists in this repo — assessing against the PR description and linked Dependabot/Vanta alert alone.

Verification performed

• Diff is confined to package-lock.json (+7/-7): fast-uri 4.1.1 → 4.1.2 and brace-expansion 5.0.7 → 5.0.9. package.json is untouched, as claimed.
• Both entries carry "dev": true in the lockfile → dev-only, no impact on the packaged/shipped extension runtime.
• Cross-checked npm registry: fast-uri@4.1.2 is the current latest (real, non-typosquat); brace-expansion@5.0.9 exists and its registry engines value (20 || >=22) matches the lockfile change byte-for-byte — no hand-tampering of the resolved tree.
• CI (.github/workflows/publish.yml) runs npm ci on Node 20; no .npmrc/engine-strict, no .nvmrc.

Findings

Critical

(none)

Suggestion

(none)

Information

• Functionality / environment (package-lock.json:2251 — brace-expansion engines): the new brace-expansion@5.0.9 drops Node 18 (node: "20 || >=22"). This is inert here — it's a dev dependency, CI pins Node 20, and there is no engine-strict so even a Node-18 dev machine would only see a warning, not an install failure. The PR body already calls this out; noting only for completeness for any contributor still on Node 18.
• Software engineering: no tests accompany the change, which is appropriate — a transitive lock-file bump has no changed behavior to cover, and npm ci + npx vsce package in CI exercises install integrity. PR reports npm run compile succeeds and npm audit → 0 vulnerabilities.
• Security: this is a security improvement (clears the remaining Dependabot/Vanta alert). No secrets, tokens, or PII introduced; no auth paths touched; --force avoided so no unexpected major bumps.
• Performance: no runtime or query-path changes; N/A.

Verdict

approved — no Critical findings. Safe, well-scoped dependency remediation. (Informational; the explicit GitHub green-check approval remains a separate human action.)