fix(deps): pyjwt 2.15.0 in the bot, serialize-javascript 7.1.2 in the frontend lockfile (#995) #997

Merged

claude-bot merged 2 commits from fix/deps-audit-2026-10-01 into main

2026-10-01 18:53:45 +00:00

claude-bot commented

2026-10-01 17:54:48 +00:00

Collaborator

Closes #995. The scheduled Dependency Audit went red on 1 Oct (run https://git.rhoving.com/rbrooks/Quest-Board/actions/runs/1740).

Bot: pyjwt 2.14.0 → 2.15.0 (CVE-2026-101918). Pulled in through redis.
Frontend: serialize-javascript 7.1.1 → 7.1.2 in the lockfile (GHSA-gfhx-hw2g-v5hg). A build-time dependency through vite-plugin-pwa → workbox-build → @rollup/plugin-terser; it is not shipped. The existing ^7.0.3 range already allowed the fix, so package.json is unchanged.

No allowlist entry.

Checked

scripts/check_npm_audit.mjs, with and without --omit=dev: no advisories.
pip-audit -r bot/requirements.txt: no known vulnerabilities.
Bot tests with pyjwt 2.15.0: 690 passed, 1 skipped.
Changelog check OK (a security fragment).

🤖 Generated with Claude Code

Closes #995. The scheduled Dependency Audit went red on 1 Oct (run https://git.rhoving.com/rbrooks/Quest-Board/actions/runs/1740). - **Bot:** `pyjwt` 2.14.0 → 2.15.0 (CVE-2026-101918). Pulled in through `redis`. - **Frontend:** `serialize-javascript` 7.1.1 → 7.1.2 in the lockfile (GHSA-gfhx-hw2g-v5hg). A build-time dependency through `vite-plugin-pwa` → `workbox-build` → `@rollup/plugin-terser`; it is not shipped. The existing `^7.0.3` range already allowed the fix, so `package.json` is unchanged. No allowlist entry. ## Checked - `scripts/check_npm_audit.mjs`, with and without `--omit=dev`: no advisories. - `pip-audit -r bot/requirements.txt`: no known vulnerabilities. - Bot tests with pyjwt 2.15.0: 690 passed, 1 skipped. - Changelog check OK (a `security` fragment). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits

2026-10-01 17:54:48 +00:00

fix(deps): pyjwt 2.15.0 in the bot and serialize-javascript 7.1.2 in the frontend lockfile (#995 ) b43366d314

The scheduled Dependency Audit went red on CVE-2026-101918 (pyjwt, through
redis) and GHSA-gfhx-hw2g-v5hg (serialize-javascript, a build-time dependency
through vite-plugin-pwa). Both have fixed releases inside the ranges already
allowed; no allowlist entry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into fix/deps-audit-2026-10-01

CI / Bot/backend version sync (pull_request) Successful in 31s

Details

CI / Does this change touch the recording path? (pull_request) Successful in 35s

Details

CI / Synthetic session harness (no GPU, no LLM) (pull_request) Has been skipped

Details

CI / Backend lint (ruff) (pull_request) Successful in 1m10s

Details

CI / Feedback site tests (pull_request) Successful in 1m45s

Details

CI / Docker image build (pull_request) Successful in 1m36s