[sds]

Summary

Rebased onto #102, which cleared the earlier pnpm audit failure. This PR moves the dependencies #102 upgraded to their newer patch releases, fixes a range mismatch in a pinned dependency, and clears GHSA-p458-7748-mcp3. That advisory was published after #102 and also fails main's audit: Vitest servers misapply server.fs.deny. It needs vite-plus 1.3.0 and Vitest 5.0.5.

Dependency	main (#102)	This PR
@tanstack/react-start	1.168.60	1.169.2
@tanstack/react-router	1.170.41	1.170.44
@tanstack/router-plugin	1.168.42	1.168.46
hono (direct and transitive)	4.13.11	4.13.13
@modelcontextprotocol/sdk	1.32.0	1.32.1
vite-plus / vite-plus-core	1.1.0	1.3.0
vitest (and @vitest/*)	5.0.3	5.0.5
@cloudflare/vitest-plugin	1.4.0	1.4.2
seroval	1.6.7	1.6.9
@babel/core	7.29.6	7.29.7

• @babel/core: router-plugin requires ^7.29.7, but main forces 7.29.6.
• TanStack Start 1.169:
  • .inputValidator() was renamed to .validator(); this updates 3 call sites.
  • The lazy server-entry patch is regenerated as @tanstack__react-start@1.169.2.patch. Upstream's createServerEntry now adds request scoping and error handling, so the patch lazy-loads it too.
• Workers test cache: Since 5.0.4, Vitest turns on fsModuleCache by default. vitest-plugin 1.4.2 can't read that cache, so every Workers test file failed with readAll … .vitest-cache: no such file or directory (fixed in vitest-plugin 1.4.3). The cache is disabled for the Workers project only, with a TODO to remove it once vitest-plugin is on 1.4.3. 1.4.3 is still under Aegis's 7-day limit.
• workerd build: workerd@1.20261012.1 (from vitest-plugin 1.4.2's Miniflare) is added to allowBuilds.
• Release-age excludes: the vite-plus@1.1.0 and @babel/core@7.29.6 entries are removed. The new versions are older than the 1-day minimum release age.
• Aegis age limit: locally, Socket Aegis blocks npm versions less than about 7 days old. Aegis exceptions were added for vite-plus 1.3.0 / Vitest 5.0.5 and their pinned packages. Every other version is at least 7 days old. Transitive srvx is pinned to 1.0.5 in the lockfile only. No overrides or audit suppressions are added.

Validation

• pnpm audit: only the two existing image-size findings remain (ignored).
• pnpm check, pnpm check:types, pnpm build: pass. The frozen-lockfile install passes, and pnpm install --lockfile-only leaves the lockfile unchanged.
• Unit tests: 57/57 pass on Vitest 5.0.5.
• E2E: 22/22 pass.
• Reproduced the Workers failure in a minimal Worker project using this repo's installed vitest-plugin 1.4.2 and Vitest 5.0.4. CI's Workers job passes with the workaround. With fsModuleCache: true it fails with CI's exact error; with false it passes. The resolved config shows fsModuleCache off for workers and on for unit.
• Worker tests were not run locally because the ghcr pull of the pinned Tempo image is denied. CI covers them, as it did for fix: upgrade vulnerable dependencies and migrate worker tests #102 on vitest-plugin 1.4.0.

[claude]

I reviewed this PR and didn't find any bugs. It's a broad toolchain and framework upgrade (TanStack Start, Vite+ 1.x, Vitest 5, a new Cloudflare test plugin), and you note the Workers test suite hasn't run yet, so a human look would still be worthwhile.

What was reviewed:

• The regenerated react-start 1.169.2 patch: fetch and createServerEntry both lazy-import @ tanstack/react-start/server and cache the promise, which keeps the original intent.
• pnpm-workspace.yaml: override bumps, the removed braces patch and its GHSA ignore, the dropped vite-plus-core extension, and the packageExtensions entry renamed to @ cloudflare/vitest-plugin.
• The Vitest v4 compatibility settings in vite.config.ts, the .inputValidator() to .validator() renames at 3 call sites, and the mechanical switch of test imports to vite-plus/test.

Extended reasoning...

The change upgrades runtime dependencies (TanStack Start/Router, hono), swaps the test toolchain to Vite+ 1.2.0 and Vitest 5 with a renamed Cloudflare Workers test plugin, replaces a local patch to the server entry, and removes the braces security patch and its regression tests. None of it touches auth, crypto or data-handling logic. The changes to app code are only the server-function validator renames. I deferred because of how big the change is (the lockfile alone has about 2,600 changed lines), because of the major-version toolchain jumps, and because the Workers test suite has not run anywhere yet, with an open upstream workerd/Vitest 5 bug that could affect it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​voidzero-dev/​vite-plus-core@​1.1.0 ⏵ 1.3.0	+1		+1	+1
	@​tanstack/​router-plugin@​1.168.42 ⏵ 1.168.46				+1
	vitest@​5.0.3 ⏵ 5.0.5			+1
	@​cloudflare/​vitest-plugin@​1.4.0 ⏵ 1.4.2			+1	+1
	@​tanstack/​react-router@​1.170.41 ⏵ 1.170.44			+1	+1
	@​tanstack/​react-start@​1.168.60 ⏵ 1.169.2				+1
	hono@​4.13.11 ⏵ 4.13.13	+1		+1	-1
	vite-plus@​1.1.0 ⏵ 1.3.0		+2		+2

View full report

[claude]

I reviewed the rebased version of this PR and didn't find any bugs. It hand-patches TanStack Start's server entry and renames the validator API on three server functions, one of them session-gated, so a human look would still be worthwhile.

What was reviewed:

• The 1.169.2 patch: fetch and the lazy createServerEntry wrapper each cache one import promise and delegate fetch. A rejected import stays cached, the same as the 1.168.60 patch.
• .inputValidator -> .validator in src/function/dash.ts and src/routes/confirm/$token.tsx / src/routes/connect/$token.tsx. The zod schemas are unchanged. I couldn't confirm the rename against the 1.169.2 sources because dependencies aren't installed here.
• The pnpm-workspace.yaml overrides, catalog, allowBuilds and release-age excludes match the version bumps. The lockfile adds no non-registry sources.

Extended reasoning...

The change bumps TanStack Start/Router, Vite+, vitest, hono and several overrides, regenerates about 1,600 lockfile lines and replaces a local patch to @ tanstack/react-start's default server entry. The security-sensitive part is the three server functions whose input validation now relies on the renamed .validator() builder: one is session-gated (disconnecting a dashboard account) and two load data by token. The patched server entry affects every request's startup path. I couldn't confirm the API rename against the installed 1.169.2 sources, and worker tests weren't run locally, so I chose defer over approve.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Recently published: npm @vitest/browser-preview published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/browser-preview@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/browser-preview@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/browser published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/browser@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/browser@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/mocker published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/mocker@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/mocker@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/pretty-format published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/pretty-format@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/pretty-format@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/snapshot published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vite-plus@1.3.0 → npm/@vitest/snapshot@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/snapshot@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/spy published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/spy@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/spy@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/ui published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/ui@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/ui@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @vitest/utils published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/vitest@5.0.5 → npm/vite-plus@1.3.0 → npm/@vitest/utils@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vitest/utils@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-core published 6 days ago Location: Package overview From: package.json → npm/@voidzero-dev/vite-plus-core@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-darwin-arm64 published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-darwin-arm64@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-darwin-arm64@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-darwin-x64 published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-darwin-x64@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-darwin-x64@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-linux-arm64-gnu published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-linux-arm64-gnu@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-linux-arm64-gnu@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-linux-arm64-musl published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-linux-arm64-musl@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-linux-arm64-musl@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-linux-x64-gnu published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-linux-x64-gnu@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-linux-x64-gnu@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-linux-x64-musl published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-linux-x64-musl@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-linux-x64-musl@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-win32-arm64-msvc published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-win32-arm64-msvc@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-win32-arm64-msvc@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm @voidzero-dev/vite-plus-win32-x64-msvc published 6 days ago Location: Package overview From: pnpm-lock.yaml → npm/@voidzero-dev/vite-plus-core@1.3.0 → npm/vite-plus@1.3.0 → npm/@voidzero-dev/vite-plus-win32-x64-msvc@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@voidzero-dev/vite-plus-win32-x64-msvc@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm vite-plus published 6 days ago Location: Package overview From: package.json → npm/vite-plus@1.3.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite-plus@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Recently published: npm vitest published 6 days ago Location: Package overview From: package.json → npm/vitest@5.0.5 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@5.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block

View full report

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[github-actions]

The latest Tipbot preview deployment for c70a257

Name	Status	Preview	Updated (UTC)
pr106	Shut Down	pr106.tip.bot	Oct 21, 2026, 9:35 PM