[superbot-helper]

@usebruno/cli is pinned at 3.0.3 at node_modules/@usebruno/cli
by the committed api-flows/package-lock.json (the root manifest declares ^3.0.3 under
devDependencies), inside the affected range of CVE-2026-34841 / GHSA-658g-p7jg-wx5g.

The advisory names 3.2.1 as the first patched version.
The root declared range ^3.0.3 admits 3.2.1
(computed), so this is a lockfile-only update: api-flows/package.json is not touched, and
api-flows/package-lock.json moves @usebruno/cli from
3.0.3 to 3.5.3.

What changes

• @usebruno/cli: 3.0.3 -> 3.5.3 at every lockfile path (1).
• No manifest is touched; no source file is changed.

Verification

• npm ci --dry-run on the patched lockfile with the unchanged manifest: pass (see verification.json).
• Every lockfile path resolving @usebruno/cli is at or above the advisory's
  first patched version 3.2.1 (node_modules/@usebruno/cli @ 3.5.3 is the built worst copy).
• api-flows/package.json is byte-identical to the base commit (sha256 78bca0094427a1b9…).
• Applied to a fresh clone of Women-Coding-Community/wcc-backend@abd047c0ccdfe9ae4e12759f1a00704ce7dac5a8, the bundle touches only api-flows/package-lock.json.
• unrelatedChurn: 1423 lines outside @usebruno/cli across 113 lockfile entries: the dependency entries npm ci requires to move with it. No source file is changed.
• Lockfile shape: npm's regenerated lockfile is shipped; the minimal lockfile fails npm ci --dry-run, so the regenerated lockfile is the verified artifact. npm 10.9.9 writes lockfileVersion 3, the repo's own.

Scope

@usebruno/cli is declared under devDependencies (scan scope: dev).
The affected range and the pinned version come from the picker's cycle-263 scan
report; the change is a dependency update, not a code change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud