From a876d38225ca6ea02b95cf31bf0f48eeb6e5bc9c Mon Sep 17 00:00:00 2001 From: CodeMash Date: Wed, 7 Oct 2026 16:02:18 +0300 Subject: [PATCH 1/2] docs(examples): the basic example uses current package versions examples/basic asked for @norbix.ai/react-redux ^0.1.0 and @norbix.ai/ts ^1.3.0. It now asks for ^1.8.2 and ^4.11.0 (the library's own peer range). Co-Authored-By: Claude Opus 5.5 --- examples/basic/package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/basic/package.json b/examples/basic/package.json index 28f7c3f..0b07459 100644 --- a/examples/basic/package.json +++ b/examples/basic/package.json @@ -11,8 +11,8 @@ "typecheck": "tsc --noEmit" }, "dependencies": { - "@norbix.ai/react-redux": "^0.1.0", - "@norbix.ai/ts": "^1.3.0", + "@norbix.ai/react-redux": "^1.8.2", + "@norbix.ai/ts": "^4.11.0", "@reduxjs/toolkit": "^2.12.0", "react": "^19.2.5", "react-dom": "^19.2.5", From ff86c43b6919842cdd43ba04108e8d5ea6089cf6 Mon Sep 17 00:00:00 2001 From: CodeMash Date: Wed, 7 Oct 2026 16:20:35 +0300 Subject: [PATCH 2/2] build(deps): source-map-js 1.2.2; ignore the npm-bundled postcss-selector-parser advisory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The OSV scan started failing on two dev-only advisories published today: - GHSA-68fv-2mgg-jv7q, source-map-js 1.2.1 → 1.2.2 in the lockfile. - GHSA-rj75-hqrm-r3gf, postcss-selector-parser 7.1.4 is bundled inside the npm CLI that @semantic-release/npm runs; npm 11.21.0 still bundles it, so it joins the existing npm-bundle ignores until 2026-11-03. Co-Authored-By: Claude Opus 5.5 --- osv-scanner.toml | 5 +++++ package-lock.json | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 69dfd76..be5bf4d 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -63,3 +63,8 @@ reason = "dev-only: bundled inside the npm CLI that @semantic-release/npm runs a id = "GHSA-rfgv-xxqx-mfg5" # undici 6.28.0 (npm bundle) ignoreUntil = 2026-11-03 reason = "dev-only: bundled inside the npm CLI that @semantic-release/npm runs at release time; the latest npm 11 (11.21.0, the range semantic-release accepts) still bundles this version and overrides cannot change bundled packages. Not part of the published package." + +[[IgnoredVulns]] +id = "GHSA-rj75-hqrm-r3gf" # postcss-selector-parser 7.1.4 (npm bundle) +ignoreUntil = 2026-11-03 +reason = "dev-only: bundled inside the npm CLI that @semantic-release/npm runs at release time; the latest npm 11 (11.21.0) still bundles 7.1.4 and overrides cannot change bundled packages. Not part of the published package." diff --git a/package-lock.json b/package-lock.json index aaaefad..5ce970c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10312,9 +10312,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "dev": true, "license": "BSD-3-Clause", "engines": {