[knowlet]

Summary

• Refresh 24 development-only package records within their existing ranges. Keep package.json and Jest 29.7.0 unchanged.
• Replace vulnerable Babel, browser-targeting, brace-expansion and js-yaml versions.
• Add two bounded security regressions to the existing Jest command and document the exact audit snapshot and remaining finding.

Evidence

Base main: 83ceac969392e7ea1948652d0b2dd6d06233ddeb.
Head: ff2cb6d988391ab31324c78c477fce40b3c13e84.
Verified published tree: 0207e3c0790c0dcbe284ae9b357408c9276d94f3.

Independent assistant-cloud checks:

• Node 24.22.1 / npm 11.9.0: locked npm ci succeeded and 70/70 Jest tests passed.
• Negative control with the original main lockfile and the identical final tests: 68 passed / 2 failed. The zero-step brace child aborts under its heap cap; old js-yaml ignores the empty-merge-source budget.
• Python 3.12.14 / pytest 9.2.0: 27/27 existing main installer tests passed.
• JavaScript/Python syntax checks, dependency-tree validation and whitespace diagnostics passed. No separate build/lint script is configured.
• All 15 baseline source files were matched to exact-main Git blob SHAs. Published tree comparison changes only package-lock.json and adds the regression/documentation files.

Exact-head hosted CI 41947175892 completed successfully at 2026-11-05 01:15:04 UTC. Node 18.20.8 and Node 20.20.2 each passed locked npm ci and 70/70 Jest tests; Python 3.11.17 passed 27/27 tests. All three checkout logs identify merge ref 05d89283087a8967bbb6b02837722eb44ec865cb, whose parents are the exact head and unchanged base above and whose tree equals the published head tree. This is verified merge-ref CI, not a claim that jobs checked out the bare head. GitHub warns that the existing checkout/setup actions use the forced Node 24 action runtime; the application-test versions above are confirmed separately in their logs.

Security result and boundaries

Current npm 11.9.0 audit changes from 49 affected package entries (34 low, 2 moderate, 13 high) across 16 distinct advisory URLs to 6 low entries with one distinct advisory. These counts include propagated dependency effects and are not counts of demonstrated project exploits. npm audit --omit=dev reports zero findings.

Deepmerge GHSA-gcqx-w48m-w2h4 remains under jest-config. No patched deepmerge version is published; npm proposes a breaking downgrade to Jest 25.1.0. This PR does not force that downgrade, suppress the finding, or claim the development toolchain is fully clean.

These are development-toolchain fixes. No npm runtime dependency, RPG Maker plugin code, Python installer, workflow, permission, credential, merge, deployment or release is changed. Existing installer Draft #5 is independent and untouched.

Research, advisory links, checks and reproducible commands.

Summary by Sourcery

Refresh the Jest development dependency lockfile to address known transitive vulnerabilities while preserving the existing Jest version and production dependency surface.

Bug Fixes:

• Refresh vulnerable transitive Jest development dependencies within their existing version ranges.
• Add bounded regression coverage for brace-expansion and js-yaml security fixes.

Enhancements:

• Document the dependency security findings, audit results, remaining deepmerge advisory, and verification boundaries.

Documentation:

• Add research documentation describing the dependency refresh, security audit evidence, and reproducible verification commands.

Tests:

• Extend the existing Jest test suite with dependency-level security regression tests.

---

Summary by cubic

Refreshes the Jest development lockfile to replace vulnerable transitive packages (Babel, browserslist, brace-expansion, js-yaml) with patched versions within their existing ranges, keeping jest@29.7.0 and package.json unchanged. Adds two regression tests that catch re-introduction of the patched issues, and documents the audit snapshot; one low-severity deepmerge advisory remains because no patched release exists.

Verification

• Locked npm ci and all 70 Jest tests pass on Node 24; the new tests fail against the original lockfile as expected.
• All 27 Python installer tests pass; the refresh touches only package-lock.json and adds test/documentation files.

^{Written for commit ff2cb6d. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sourcery-ai]

Reviewer's Guide

This PR refreshes 24 development-only transitive Jest dependency records in package-lock.json, adds focused regressions for brace-expansion and js-yaml vulnerabilities, and documents the audit results and remaining deepmerge finding without changing package.json, Jest, runtime code, or deployment behavior.

Sequence diagram for dependency security regression tests

sequenceDiagram
    participant Jest
    participant Test as dependency-security.test.js
    participant Node
    participant Brace as brace-expansion
    participant YAML as js-yaml

    Jest->>Test: run regression tests
    Test->>Node: spawn brace expansion with heap cap and timeout
    Node->>Brace: expand('{1..2..0}')
    Brace-->>Node: ['1', '2']
    Node-->>Test: successful bounded result
    Test->>YAML: parse four empty merge-source mappings with budget 3
    YAML-->>Test: budget exceeded
    Test->>YAML: parse ordinary document with budget 4
    YAML-->>Test: document accepted
    Test-->>Jest: pass

Loading

File-Level Changes

Change	Details	Files
Refresh the committed Jest development dependency lockfile within existing version ranges to remove vulnerable transitive versions while preserving the manifest and Jest 29.7.0.	Update vulnerable Babel, browser-targeting, brace-expansion, js-yaml, and companion package records. Keep all changes development-only with no runtime, application, installer, workflow, or deployment changes. Leave the deepmerge advisory under Jest unresolved rather than forcing a breaking Jest downgrade or suppressing the finding.	package-lock.json
Add bounded regression tests covering the two dependency behaviors addressed by the refresh.	Run zero-step brace expansion in a constrained child process and require normalized output without hanging the Jest worker. Verify js-yaml enforces the configured merge-key budget while accepting the boundary case.	tests/dependency-security.test.js
Document the dependency refresh rationale, audit snapshot, remaining advisory, validation evidence, and reproduction commands.	Record affected package updates, audit counts, deepmerge limitations, and production audit scope. Document test results, negative-control behavior, integrity identifiers, and compatibility boundaries.	docs/research/jest-dependency-security.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.