[kanywst]

Clears the open Dependabot alerts (minimatch medium, re2js high) before this repo is archived. Both are dev-only transitive dependencies that npm audit fix cannot reach, so they are pinned with overrides, as in 0-draft/aws-credentials#18:

• minimatch → 11.0.5 (via eslint / typescript-eslint; no patched 10.x exists)
• re2js → 2.9.1 (markdownlint-cli2 0.24.0 pins markdownlint 0.42.0, which pins the vulnerable re2js)

Verification (local)

• npm audit → found 0 vulnerabilities
• npm run check (typecheck, lint, format, markdownlint, 67 tests, build) → pass

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 84c696d9-c70a-409e-b83f-24876ab83fcf

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[claude]

No findings. Dependency-only change (minimatch/re2js overrides plus lockfile); engines (node >=24) satisfy the new node >=20 requirements, and there are no content or workflow changes.