[vvillait88]

Summary

Release 2.9.2. This is a lockfile refresh that moves vite from 8.2.2 to 8.3.4, clearing three advisories against vite's dev server (GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw). vite reaches this repo only through vitest, so it runs at test time and never ships in the package.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged. The version moves to 2.9.2 so the release is published; no source file changes.

Test plan

• bun run lint, bun run typecheck, bun run test (154 passed, 2 skipped).
• osv-scanner on bun.lock: no issues found. Before this change it reported the three vite advisories.

Not done: no source changes, so no new tests.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior; the existing suite passes, 154 tests)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review of head 95a8ad3 against base 65439a6. No blocking findings.

Diff scope

• 2 files: package.json (+1/-1, version 2.9.1 to 2.9.2 only) and bun.lock (+22/-18).
• Every changed lock line read. Moved: vite 8.2.2 to 8.3.4; rolldown 1.2.6 to 1.2.14 with all 15 @rolldown/binding-* entries (vite's own dep, range now ~1.2.12); rolldown/@oxc-project/types 0.147.0 to 0.154.0 (rolldown's pinned =0.154.0). Added: nested vite/postcss 8.5.31 and vite/postcss/nanoid 3.3.20, because vite 8.3.4 asks for postcss ^8.5.29 and the hoisted postcss stays at 8.5.26. Nothing outside vite's subtree moved; osv-scanner counts 388 packages on base and 390 on head, matching the two nested additions.

Runtime surface

• package.json at the head sha declares no dependencies, peerDependencies or optionalDependencies; vite is not even a direct devDependency, it arrives through vitest / @vitest/coverage-v8. The published package's dependency set is empty before and after, so nothing consumers install changes.

Release state

• v2.9.2 is not a tag (latest tags: v2.9.1, v2.9.0, v2.8.1).
• npm view @agent-score/sdk versions ends at 2.9.1, so 2.9.2 is unpublished.

osv-scanner 2.7.0, scan source --lockfile

• Head lockfile: exit 0, 390 packages, "No issues found".
• Base lockfile (positive control): exit 1, 3 vulnerabilities in vite 8.2.2 (GHSA-587h-7wmj-h5pm CVSS 7.5, GHSA-698v-4r3x-3vcv 6.3, GHSA-r825-w8mm-5pxw 6.3), fixed in 8.2.4. So the scan does see these advisories and the head clears all three.

CI

• gh pr checks 109: 9 rows, all pass (ci, node-compat 22/24/26, Dependency Scan, CodeQL and both Analyze jobs).

PR body

• Follows the repo template (Summary, Type of change, Public API, Test plan, Checklist). Unticked docs item carries its reason. Zero em-dashes, no ticket ids, no session links in title, body or commit message.

Non-blocking notes

• "Tests cover the new behavior" is ticked on a change with no new behavior. The suite passing is true (CI green), so this reads fine, but the item is closer to not applicable than verified.
• The hoisted postcss stays at 8.5.26 alongside the nested 8.5.31. Harmless and osv-clean; a later bun update would likely dedupe it. Not worth holding this release for.

[vvillait88]

Both notes answered. Checklist: the tests box is now unticked with the reason (no new behavior; the existing suite passes), since 'not applicable' is the accurate state. postcss: the nested 8.5.31 is what vite asks for and the hoisted 8.5.26 is unrelated to this change; left as is, osv-clean on both.