[turip]

Patch the JavaScript SDK build, generation, and test dependency graph to address its 13 high and 7 medium Dependabot records. Select Vite 7.3.7 explicitly, upgrade Vitest to 4.1.12 for follow-up mocker fixes, and enforce patched transitive versions of brace-expansion, fast-uri, form-data, js-yaml, and markdown-it.

Validation:

• SDK generation and dual ESM/CommonJS build; regeneration produces no tracked output changes.
• Vitest tests and TypeScript/Biome checks.
• Live dependency audit has no moderate, high, or critical findings. One existing low-severity esbuild advisory remains in development tooling.

The published SDK runtime dependencies are unchanged.

Confidence Score: 5/5

This PR appears safe to merge; no actionable issues were found.

Summary

Updates the JavaScript SDK’s development tools to address dependency advisories.

• SDK build and test tools use newer Vite and Vitest releases.
• SDK installs select patched versions of five transitive packages.

No actionable issues found. Build, generation, tests, and dependency audit were not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(javascript): patch SDK tooling vulne..." · Reviewed by Greptile}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 3

• api/client/javascript/package.json is excluded by !api/client/**
• api/client/javascript/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !api/client/**
• api/client/javascript/pnpm-workspace.yaml is excluded by !api/client/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Source mode: Auto
• Repository: openmeterio/openmeter
• Branch: feat/security-javascript-dependencies
• File: .coderabbit.yaml
• Commit: 7c4095a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8e3820af-c54a-4446-ab89-68ba38443d6e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}