From ba875c41d6f1c0218f405e814fcb76d1346d8a18 Mon Sep 17 00:00:00 2001
From: Richard Zampieri <br.developer@gmail.com>
Date: Thu, 16 Jul 2026 14:31:14 -0700
Subject: [PATCH 1/2] fix(security): bump undici to 7.28.0 to resolve
 Dependabot alerts

Regenerates package-lock.json so the transitive undici dependency
(via release-it) moves 7.24.5 -> 7.28.0, clearing the open Dependabot
undici alerts (2 high plus moderate/low). npm audit now reports
0 vulnerabilities. Build and full test suite (22 suites, 104 tests)
pass.
---
 package-lock.json | 31 +++++++------------------------
 1 file changed, 7 insertions(+), 24 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 01fe223..263089e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2153,23 +2153,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/@release-it/conventional-changelog/node_modules/conventional-commits-parser": {
-      "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-6.4.0.tgz",
-      "integrity": "sha512-tvRg7FIBNlyPzjdG8wWRlPHQJJHI7DylhtRGeU9Lq+JuoPh5BKpPRX83ZdLrvXuOSu5Eo/e7SzOQhU4Hd2Miuw==",
-      "extraneous": true,
-      "license": "MIT",
-      "dependencies": {
-        "@simple-libs/stream-utils": "^1.2.0",
-        "meow": "^13.0.0"
-      },
-      "bin": {
-        "conventional-commits-parser": "dist/cli/index.js"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@simple-libs/child-process-utils": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@simple-libs/child-process-utils/-/child-process-utils-1.0.2.tgz",
@@ -7990,9 +7973,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/release-it": {
-      "version": "20.2.0",
-      "resolved": "https://registry.npmjs.org/release-it/-/release-it-20.2.0.tgz",
-      "integrity": "sha512-9ZTk9ripgctC6VTqH+P54KuboK29A5mG/I3tFfS5hnoAnkwtFFAMHRidYz93ylrW995vF50Ny1aOGJiyRmEN7w==",
+      "version": "20.2.1",
+      "resolved": "https://registry.npmjs.org/release-it/-/release-it-20.2.1.tgz",
+      "integrity": "sha512-xd0mqTGduwQlEzVBKOJcoVZxDrRLzjmFv3W8tWwkPIPDYtwYBWYjULiSk6VhfuGKocfz7GmptAqViKMQV4Zzbw==",
       "dev": true,
       "funding": [
         {
@@ -8025,7 +8008,7 @@
         "proxy-agent": "7.0.0",
         "semver": "7.7.4",
         "tinyglobby": "0.2.15",
-        "undici": "7.24.5",
+        "undici": "7.28.0",
         "url-join": "5.0.0",
         "wildcard-match": "5.1.4",
         "yargs-parser": "22.0.0"
@@ -9019,9 +9002,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.24.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.5.tgz",
-      "integrity": "sha512-3IWdCpjgxp15CbJnsi/Y9TCDE7HWVN19j1hmzVhoAkY/+CJx449tVxT5wZc1Gwg8J+P0LWvzlBzxYRnHJ+1i7Q==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
       "dev": true,
       "license": "MIT",
       "engines": {

From 8c9b3d835f4c132ef057f7d24e4ed4d70b12171d Mon Sep 17 00:00:00 2001
From: Richard Zampieri <br.developer@gmail.com>
Date: Thu, 16 Jul 2026 14:43:47 -0700
Subject: [PATCH 2/2] fix(ci): regenerate package-lock.json with npm 10 for npm
 ci

The prior lockfile was produced with npm 11, leaving release-it's
subtree out of sync for npm 10 (used in CI via Node 20.18.0) and
breaking `npm ci`. Regenerated with npm 10; undici stays 7.28.0 and
npm audit reports 0 vulnerabilities.
---
 package-lock.json | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/package-lock.json b/package-lock.json
index 263089e..ba3ec89 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2153,6 +2153,25 @@
         "node": ">=18"
       }
     },
+    "node_modules/@release-it/conventional-changelog/node_modules/conventional-commits-parser": {
+      "version": "6.4.0",
+      "resolved": "https://registry.npmjs.org/conventional-commits-parser/-/conventional-commits-parser-6.4.0.tgz",
+      "integrity": "sha512-tvRg7FIBNlyPzjdG8wWRlPHQJJHI7DylhtRGeU9Lq+JuoPh5BKpPRX83ZdLrvXuOSu5Eo/e7SzOQhU4Hd2Miuw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@simple-libs/stream-utils": "^1.2.0",
+        "meow": "^13.0.0"
+      },
+      "bin": {
+        "conventional-commits-parser": "dist/cli/index.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@simple-libs/child-process-utils": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@simple-libs/child-process-utils/-/child-process-utils-1.0.2.tgz",