[skyfallwastaken]

bun audit in CI started failing on new advisories, which blocks every PR (including #161). Nothing in our code changed.

• Upgraded within existing ranges: vite 8.3.1 → 8.3.3 (with its bundled rolldown 1.2.10 → 1.2.15) and source-map-js 1.2.1 → 1.2.2, via bun audit fix. Lockfile only; package.json is unchanged.
• Ignored, no patched release exists: deepmerge (GHSA-gcqx-w48m-w2h4, low) is already at its latest 4.3.1, and @tailwindcss/typography 0.5.20, the latest, pins postcss-selector-parser 6.0.10 exactly (GHSA-rj75-hqrm-r3gf, moderate). Both run only at build time on our own config and CSS.

Verified locally: bun install --frozen-lockfile, typecheck, svelte-check, bun test (353 pass), bun run build, and the new audit step all pass.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​8.3.1 ⏵ 8.3.3	+1	+22	+1

View full report