[dependabot]

Problem

The docs template locks source-map-js 1.2.1, which accepts malicious indexed maps that can cause denial of service.
The shell parser and image library also have upstream fixes.
Dependabot changed six root lockfile dependency ranges and broke CI.

Change

Root package and lockfile
  shell-quote 1.9.0 -> 1.11.0
  Preserve six devDependency ranges as latest.
Docs template lockfile
  sharp 0.35.4 -> 0.35.5
  sharp platform binaries follow the matching release.
  source-map-js 1.2.1 -> 1.2.2

Merge current main without rewriting branch history.
The diff against main contains three files.

Proof

Check	Before	After
Root lockfile validator	Six latest ranges differ from the lockfile	Pass
Oversized indexed source map	1.2.1 accepts the oversized section offset	1.2.2 rejects it
bun run check	CI stops at lockfile validation	Pass, including both Rust suites
bun run pack:dry	Not rerun on the old head	Pass, 312 files
Isolated pi -e . load	Not rerun on the old head	Package command registered
Generated docs site check and build	Not rerun on the old head	Pass, six pages built
Native sharp PNG resize	Not rerun on the old head	Pass with 0.35.5
Source map mapping round trip	Not rerun on the old head	Pass with 1.2.2
Independent Opus review	No review on the old head	No Act On findings on c491dab

Local checks and the review receipt cover c491dab.
The reviewer checked all 28 changed package entries against registry metadata and compared 30 shell commands between parser versions.
Hosted CI and Pullfrog approval must pass on the same head before merge.

Review

Finding	Disposition	Reason
Dependabot changes latest ranges to wildcard ranges	Fix	Restore manifest values. The same validator fails before and passes after.
Docs lockfile lacks automatic metadata validation	Decline	Existing coverage gap at scripts/validate-lockfile.mjs:23. Independent review verified both manifest and lockfile pairs.
Redundant shell-quote types package	Decline	Existing dependency at package.json:79. Removing it is outside this update.
Generated Bun lockfile in template	Fix	Remove verification output. The final tree is clean.

Merge danger

Door: two-way. Revert this PR to restore the previous dependency versions.
Blast radius: low. Bash command parsing and generated docs builds use these packages.
The full checks, parser comparison, native image test, and generated docs build passed.
No deviations from the requested dependency update. The added repair restores matching lockfile metadata.
Stop at merge readiness. Merge is not authorized by this request.

Changes made by GPT-6.1 Sol via Codex

[coldtea-pr-lens]

Note

dependabot[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: AojdevStudio/agentic-utilities/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: eaeb77d5-d0ee-4deb-b181-b1a51532afcf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[AojdevStudio]

@pullfrog Please review PR #69 at c491dab and publish the pullfrog-approval verdict on that exact head.

Review only. Do not edit the branch or merge it.
The dependency diff contains three files. Local checks, package loading, the generated docs build, and an independent Opus review passed.
The source-map security check fails on 1.2.1 and passes on 1.2.2. The PR body carries the evidence.

Spec fidelity. No deviations from the dependency update. The additional repair restores six lockfile ranges to match the manifest.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the complete three-file dependency diff and the lockfile repair at c491dab0df9b53654c5d3708aa4b769ac1087e07; no deviations from the requested dependency update.

• Shell parser: Updates shell-quote from 1.9.0 to 1.11.0, with matching manifest and lockfile values and verified bash-guard integration.
• Docs image dependencies: Updates sharp to 0.35.5 and aligns its platform packages and libvips dependencies; registry metadata and native PNG resizing passed independent checks.
• Source-map security: Updates source-map-js to 1.2.2; independently confirmed that 1.2.1 accepts the oversized indexed map while 1.2.2 rejects it, including excessive cumulative nested offsets, and preserves normal mapping round trips.
• Lockfile fidelity: The repair restores six latest ranges to match the manifest; both manifest/lockfile pairs are consistent, and the repair introduces no additional net change against main.

Verification passed: full npm run check and npm run pack:dry through the Bun bootstrap, offline pi -e . package loading, typechecking, 20 old/new parser comparisons, and the focused security/image smoke tests. Reviewed the PR's generated-docs build evidence; that build was not rerun in this review. Hosted checks also passed on this exact head. No branch edits or merge performed.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[AojdevStudio]

No deviations from the requested dependency update. The final diff contains only the root shell-quote update and docs-template sharp and source-map-js updates.

All hosted checks, including pullfrog-approval, passed on c491dab. Pullfrog approved that head with no findings. No unresolved review threads remain.

Ossie authorized merging in this thread. This supersedes the earlier stop-at-readiness note in the PR body.