[jasdeepkhalsa]

Clears npm audit across the repo, and makes CI fail on any advisory that someone installing SupaForge would get.

What users install

Published 0.0.41, installed into an empty directory, had one moderate advisory: minimatch GHSA-g3hv-75wg-m249, pulled in by @oclif/core.

• The latest @oclif/core (5.1.11) still requires minimatch ^10.2.5, and the fix is in 11.0.1. Upstream's bump is fix(deps): bump minimatch from 10.2.6 to 11.0.1 oclif/core#1664, open.
• SupaForge can't fix this for its users yet:
  • An overrides entry in our package.json only applies inside this repo, never to someone installing the package.
  • A shipped npm-shrinkwrap.json holding minimatch 11 was tested: it lands in the tarball, but npm ignores the pinned version because 11 is outside oclif's range, and installs 10.2.6 anyway.
• oclif only uses minimatch to match its own plugin names, never user input. With the override in place, the CLI and its tests run on minimatch 11.

So it is the single entry in packages/cli/scripts/audit-exceptions.json, with the reason and when to remove it.

Changes

• check-package.mjs already installs the packed tarball into an empty directory and runs it. Now it also audits that install:
  • It fails on any advisory not in audit-exceptions.json.
  • It fails on an exception that no longer applies, so the list only shrinks.
  • It runs on PRs, on main, weekly, in the release dry run, and before publishing.
  • I checked both failure modes locally: an empty exceptions file fails on the minimatch advisory, and a made-up entry fails as stale.
• CLI lockfile:
  • @hono/node-server 2.1.6 for GHSA-rmxm-3fg6-px4f (moderate, via the MCP SDK).
  • Overrides take minimatch to 11.0.5 and esbuild to 0.28 (GHSA-g7r4-m6w7-qqqr, dev only).
  • Build, tsc and all 1950 unit tests pass.
• VS Code lockfile: overrides for minimatch, glob, diff and serialize-javascript, all dev tooling (vsce, mocha, test-cli). This also covers the daily Dependabot runs that were failing on the same packages. vsce package still works.
• security.yml:
  • Each package's lockfile (cli, mcp, and now vscode) must audit clean at any severity.
  • Before, the bar was runtime high, or critical with dev tooling.

npm audit: 0 vulnerabilities in cli, mcp and vscode.

🤖 Generated with Claude Code