[waleedlatif1]

Summary

• Bump the qs (6.16.0 → 6.16.1, GHSA-6pq8) and fast-uri (3.1.8 → 3.1.9, GHSA-w74x/xhq7/wjr9/333x) override pins; the pinned versions were themselves the vulnerable releases
• Drop the artillery devDependency (~300 lockfile entries, plus its csv-parse 4 / moment advisories); the three load:workflow:* scripts run bunx artillery@2.0.34
• Remove the minimatch / brace-expansion overrides: forcing minimatch 10 (no default export) onto CommonJS consumers like @electron/asar (minimatch_1.default(...)) is a latent TypeError, and every major line now resolves to a patched backport (3.1.5 / 5.1.9 / 9.0.9 / 10.2.6, brace-expansion 1.1.21 / 2.1.7 / 5.0.12)
• Remove redundant overrides (socket.io, drizzle-orm, baseline-browser-mapping resolve the same versions without them; joi only came in through artillery), sharp from trustedDependencies (no lifecycle scripts), and the temporary electron release-age exclude. The electron@latest canary passes --minimum-release-age=0 so it still tests the real latest
• @xyflow/react is a devDependency of workflow-persistence (type-only import)
• Declare buffer, process, chai, tinyrainbow, which the sandbox bundle build imports but which only resolved through hoisting

Type of Change

• Chore (dependency maintenance)

Testing

• bun install lock diff: only the intended versions changed, no other version churn; 2968 → 2669 lockfile entries
• bun audit: 47 → 40, nothing new; no minimatch/brace-expansion findings
• bun pm untrusted unchanged apart from artillery-only packages; build:sandbox-bundles output identical with and without the change
• biome on changed files; type-check, check:audits (incl. knip) and the test suites run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 28, 2026 9:34pm UTC

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; no actionable issues were found.

Summary

This PR cleans up dependency declarations and the lockfile.

• Workflow load tests run pinned Artillery on demand.
• Sandbox bundle builds declare their imported tools directly.
• The root pins fast-uri and qs to newer patched releases.
• Root dependency settings stop forcing several already-resolved packages.
• Normal installs age-gate Electron while the desktop canary can test its latest release.
• Workflow persistence lists its type-only canvas package as a development dependency.

No actionable issues were found. Builds and tests were not run.

Intent noted: waleedlatif1 explicitly chose on-demand Artillery installation and a release-age bypass for the latest-Electron canary.

_{Reviews (1) · Last reviewed commit: "chore(deps): dependency hygiene cleanup" · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}