[harshit-bstack]

What

One PR for the five open security tickets on this repo.

Ticket	Package	Before → After	Advisory
PTAAA-863	vite	8.0.16 → 8.3.5	GHSA-587h-7wmj-h5pm (high), plus GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22, GHSA-9jrq-w75r-8gcw. All fixed in 8.1.6
PTAAA-847	source-map-js (via postcss)	1.2.1 → 1.2.2	GHSA-68fv-2mgg-jv7q (high)
PTAAA-852	braces	3.0.3, no fix available	GHSA-vfj7-8cjw-p6xm (high)
PTAAA-876	Node.js	24.12.0 → 24.22.1	October 2026 Node security release (CVE-2026-111497, Brotli). Changed in .nvmrc (CI reads it), package.json engines and the lockfile root
PTAAA-491	.npmrc	inline # comments → comments on their own lines	Enigma supply-chain audit (SC-12282)

braces: 3.0.3 is the latest release and the advisory has no patched version. It only comes in through tailwindcss v3 (chokidar, micromatch and fast-glob), at build time, on our own source globs. Removing it would mean migrating to Tailwind v4, which is out of scope for a security bump. We'll request a security exception on PTAAA-852.

Lockfile side effects: these all come from the vite bump and nothing else moved.

• rolldown 1.0.3 → 1.2.15, plus its platform bindings
• lightningcss 1.32 → 1.33
• postcss 8.5.26 → 8.5.31
• nanoid 3.3.18 → 3.3.20

rolldown 1.2.15 no longer ships the wasm32-wasi binding, which is why that entry is gone.

Supersedes Dependabot #59 (source-map-js) and #61 (vite).

.npmrc: npm has no inline comments, so ignore-scripts=true # blocks… set the value to that whole string. That's why the audit reported expected true, got true # blocks…. Each comment is now on its own line, and npm config get returns clean true/high/false values.

Testing

• Ran npm install with Node 24.12.0, then checked npm ls: vite@8.3.5, source-map-js@1.2.2.
• With Node 24.22.1: npm ci and npm run build pass. The Brotli check node -p "'BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH' in require('zlib').constants" prints true.
• npm config get for ignore-scripts, strict-ssl, save-exact, audit-level, engine-strict and legacy-peer-deps returns true, true, true, high, true, false.
• engine-strict is now enforced: npm ci on Node 24.12.0 fails with notsup Required: {"node":"24.22.1"}.
• npm run build passes (vite 8.3.5, 2063 modules).
• npm run lint shows 1 error, the same one already on main (tailwind.config.ts require()). This PR doesn't touch it.

Note for the Smart Selection demo

The STS demo compares demo-temp against main. Once this merges, package.json and package-lock.json will appear in that comparison until demo-temp is rebased onto the new main.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the project’s Node.js version requirement and configuration.
  • Package installation now waits seven days before resolving newly published versions.
  • Existing installation and security settings remain in place.
  • These updates affect the project’s tooling and package setup; no user-facing feature changes are included.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 3ff52628-9523-4e2a-8af3-f6edf926f592

Commits

Reviewing files that changed from the base of the PR and between edf865d and 4c39a3d.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 3

• .npmrc
• .nvmrc
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Recent review details

Additional comments: 3

.npmrc: 1

4-6: LGTM!

Also applies to: 8-21

.nvmrc: 1

1-1: LGTM!

package.json: 1

88-88: LGTM!

Also applies to: 91-91

Walkthrough

The npm configuration adds a seven-day minimum release age and moves inline explanations to separate comment lines. The project updates its Node.js version to 24.22.1 and pins Vite to 8.3.5.

Changes: Package and runtime configuration

Layer / File(s)	Summary
Update package resolution and runtime versions .npmrc, .nvmrc, package.json	The npm configuration adds a seven-day minimum release age and moves inline explanations to separate comment lines. The Node.js version changes to 24.22.1, and Vite is pinned to 8.3.5.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: Minimal · up to 4c39a

The package and runtime configuration changes are ready to merge.

Security architecture risk: Minimal · up to 4c39a

The changes align the build toolchain and strengthen package-install configuration without expanding deployment permissions or changing deployment ordering. No material security risk introduced or worsened by this PR was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A compromised build dependency could execute during npm run build in the existing job that also has Pages and OIDC permissions, potentially affecting the published site. That trust boundary predates this PR; the comparison shows no added permissions, new deployment targets, or new install/build execution steps.

Trust Boundaries and Controls

• observed — Base-to-head lockfile comparison retains registry.npmjs.org as the only resolved-package origin and introduces no new hasInstallScript declarations. These observations limit the configuration-level change in exposure but do not verify package contents or provenance.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the main security work in this PR: it bumps Vite to 8.3.5 and source-map-js to 1.2.2, moves Node to 24.22.1, and fixes .npmrc. The PR objectives confirm these are the core changes, gro…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main security work in this PR: it bumps Vite to 8.3.5 and source-map-js to 1.2.2, moves Node to 24.22.1, and fixes .npmrc. The PR objectives confirm these are the core changes, grouped under five security tickets. The title lists ticket numbers and package names, so it is specific but dense. It omits the lockfile-only changes and the braces decision, which is expected for a short title.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the version trail,
Seven days keep fresh releases at bay.
Vite is pinned, Node steps ahead,
Comments now sit above instead.
The burrow’s settings rest in place.}

_{Comment @coderabbitai help to get the list of available commands.}

[harshit-bstack]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.