chore: sync with main and run npm audit fix #5651

Copilot · 2026-01-16T05:33:30Z

Resolves audit vulnerabilities and syncs with latest main branch changes.

Changes

Merged latest main branch (commit 8ff0209) to incorporate recent updates
Ran npm audit fix using Node 22.21.1 / npm 10.9.4
Verified build and browser tests pass without webpack errors

Vulnerability reduction

Before: 58 vulnerabilities (4 low, 13 moderate, 36 high, 5 critical)
After: 32 vulnerabilities (2 low, 4 moderate, 26 high)

The previously reported webpack error ([webpack-cli] Error: For the selected environment is no default script chunk format available) no longer occurs after the merge and audit fix.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Signed-off-by: hainenber <[email protected]>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

)" (#5618)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* build: initial file implementation for ocotoguide * refactor: migrate to defaults without explicit * chore: remove compliance action

…s failed (#5519) Co-authored-by: Claude Sonnet 4.5 <[email protected]> Co-authored-by: Josh Goldberg ✨ <[email protected]> Co-authored-by: Claude <[email protected]> Co-authored-by: Mark Wiemer <[email protected]> Co-authored-by: Mark Wiemer <[email protected]>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

linux-foundation-easycla · 2026-01-16T05:33:36Z

✅ login: akshah123 / name: Ankit Shah (0ed524a)
✅ login: dependabot[bot] / name: dependabot[bot] (fed6bbd)
✅ login: github-actions[bot] / name: github-actions[bot] (2fa505c, 424516e)
✅ login: hainenber / name: Đỗ Trọng Hải (dc0fdb7)
✅ login: JoshuaKGoldberg / name: Josh Goldberg ✨ (8fa183d)
✅ login: lennonnikolas / name: Nikolas Lennon (a5f5c64)
✅ login: mark-wiemer / name: Mark Wiemer (1972dd7, 3771c47, 8ff0209, cf945fb, dba8091, ddf8644)
❌ - login: @Copilot / name: copilot-swe-agent[bot] . The commit (084e339, 7c3f5aa, ada57f2) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

Co-authored-by: mark-wiemer <[email protected]>

Copilot · 2026-01-16T05:41:04Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

accounts.google.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3917 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-92467262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18251170529287459229,455935002127108398,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /opt/google/chrome/chrome /usr/bin/google-chrome --user-data-dir=/tmp/karma-92467262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications http://localhost:9876/?id=92467262 --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 (dns block)
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=4191 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-99040986 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10948387765391822025,15998625791974088742,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
clients2.google.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3917 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-92467262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18251170529287459229,455935002127108398,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /opt/google/chrome/chrome /usr/bin/google-chrome --user-data-dir=/tmp/karma-92467262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications http://localhost:9876/?id=92467262 --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 (dns block)
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=4191 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-99040986 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10948387765391822025,15998625791974088742,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
clientservices.googleapis.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3917 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-92467262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18251170529287459229,455935002127108398,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /opt/google/chrome/chrome /usr/bin/google-chrome --user-data-dir=/tmp/karma-92467262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications http://localhost:9876/?id=92467262 --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 (dns block)
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=4191 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-99040986 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10948387765391822025,15998625791974088742,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
redirector.gvt1.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3917 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-92467262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18251170529287459229,455935002127108398,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /opt/google/chrome/chrome /usr/bin/google-chrome --user-data-dir=/tmp/karma-92467262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications http://localhost:9876/?id=92467262 --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 (dns block)
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=4191 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-99040986 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10948387765391822025,15998625791974088742,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
safebrowsingohttpgateway.googleapis.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3917 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-92467262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18251170529287459229,455935002127108398,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /opt/google/chrome/chrome /usr/bin/google-chrome --user-data-dir=/tmp/karma-92467262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications http://localhost:9876/?id=92467262 --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 (dns block)
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=4191 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-99040986 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10948387765391822025,15998625791974088742,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
saucelabs.com
- Triggering command: /usr/local/bin/node node /home/REDACTED/work/mocha/mocha/node_modules/.bin/karma start ./karma.conf.js --single-run (dns block)
- Triggering command: /usr/local/bin/node node /home/REDACTED/work/mocha/mocha/node_modules/.bin/karma start ./karma.conf.js --single-run unset --global nfig/composer/vendor/bin/bash credential.usernsh (dns block)
www.google.com
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3917 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-92467262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,18251170529287459229,455935002127108398,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)
- Triggering command: /opt/google/chrome/chrome /usr/bin/google-chrome --user-data-dir=/tmp/karma-92467262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications http://localhost:9876/?id=92467262 --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 (dns block)
- Triggering command: /proc/self/exe /proc/self/exe --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=4191 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-99040986 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,10948387765391822025,15998625791974088742,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

hainenber and others added 14 commits January 4, 2026 14:50

chore(ci): use OIDC token for trusted publishing to npm (#5610)

dc0fdb7

Signed-off-by: hainenber <[email protected]>

chore(main): release 12.0.0-beta-4 (#5598)

424516e

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Revert "chore(ci): use OIDC token for trusted publishing to npm (#5610

3771c47

)" (#5618)

chore: revert "chore(main): release 12.0.0-beta-4 (#5598)" (#5619)

dba8091

chore(main): release 12.0.0-beta-4 (#5620)

2fa505c

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

build: initial file implementation for ocotoguide (#5608)

a5f5c64

* build: initial file implementation for ocotoguide * refactor: migrate to defaults without explicit * chore: remove compliance action

docs: add missing /next/* redirects (#5627)

8fa183d

chore: cleanup issue templates (#5624)

1972dd7

chore: update spam filter (#5645)

cf945fb

build(deps): bump OctoGuide/bot in the github-actions group (#5648)

fed6bbd

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

chore: remove unused assets folder (#5638)

ddf8644

chore: update tagline (#5635)

8ff0209

Initial plan

ada57f2

Copilot AI assigned Copilot and mark-wiemer Jan 16, 2026

Copilot AI mentioned this pull request Jan 16, 2026

chore: run npm audit fix #5606

Draft

3 tasks

Copilot started work on behalf of mark-wiemer January 16, 2026 05:33 View session

Copilot AI and others added 2 commits January 16, 2026 05:35

Merge latest main into audit-fix branch

7c3f5aa

Merge latest main and run npm audit fix

084e339

Co-authored-by: mark-wiemer <[email protected]>

Copilot AI changed the title ~~[WIP] Fix vulnerabilities by running npm audit fix~~ chore: sync with main and run npm audit fix Jan 16, 2026

Copilot finished work on behalf of mark-wiemer January 16, 2026 05:41

Copilot AI requested a review from mark-wiemer January 16, 2026 05:41

JoshuaKGoldberg closed this Jan 21, 2026

mark-wiemer deleted the copilot/sub-pr-5606 branch January 22, 2026 03:09

mark-wiemer mentioned this pull request Jan 22, 2026

Transitive dependency: [email protected] DoS fix available upstream #5657

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: sync with main and run npm audit fix #5651

chore: sync with main and run npm audit fix #5651

Uh oh!

Copilot AI commented Jan 16, 2026 •

edited

Loading

Uh oh!

linux-foundation-easycla bot commented Jan 16, 2026 •

edited

Loading

Uh oh!

Copilot AI commented Jan 16, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

chore: sync with main and run npm audit fix #5651

chore: sync with main and run npm audit fix #5651

Uh oh!

Conversation

Copilot AI commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Vulnerability reduction

Uh oh!

linux-foundation-easycla bot commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Jan 16, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Copilot AI commented Jan 16, 2026 •

edited

Loading

linux-foundation-easycla bot commented Jan 16, 2026 •

edited

Loading