Kuzz007 422e193b21 fix(ci): actually make the Audit step green, not just documented as accepted ...

npm audit --audit-level=high doesn't read code comments -- it was still
exiting 1 on the one remaining, already-investigated-as-unfixable advisory
(eslint-plugin-jsx-a11y's own pinned minimatch, GHSA-mh99-v99m-4gvg), so
every run on main has actually been red despite the prior commit's comment
calling it "known-accepted". That advisory lives entirely in
devDependencies (lint tooling, never shipped), so --omit=dev is the
correct signal for "doesn't apply to what we ship" -- verified locally,
0 vulnerabilities. Runtime dependencies are still audited at high severity.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-27 00:30:17 +03:00

..

ci.yml

fix(ci): actually make the Audit step green, not just documented as accepted

2026-07-27 00:30:17 +03:00

claude-bot.yml

ci(claude-bot): structure PR review and issue triage prompts

2026-07-09 15:45:07 +02:00

cleanup_caches.yml

Run cache cleanup daily and reduce cutoff to 1 day

2026-04-21 20:36:28 +02:00

codeql.yml

chore(deps): bump actions/setup-node from 6 to 7 (#5992)

2026-07-16 13:13:55 +02:00

docker.yml

chore(deps): bump actions/checkout from 6 to 7 (#5454)

2026-06-20 22:25:41 +02:00

docs-ci.yml

chore(deps): bump actions/setup-node from 6 to 7 (#5992)

2026-07-16 13:13:55 +02:00

docs-deploy.yml

chore(deps): bump actions/setup-node from 6 to 7 (#5992)

2026-07-16 13:13:55 +02:00

mutation.yml

chore(deps): bump actions/setup-go from 6 to 7 (#5995)

2026-07-16 13:14:27 +02:00

release.yml

fix(ci): drop the now-impossible .zip glob from the dev-latest upload

2026-07-25 17:08:25 +03:00

smoke.yml

fix(ci): stop executing tag-checkout code in the release smoke test

2026-07-07 01:23:10 +02:00