fix(deps): 修复可兼容升级的依赖安全告警（undici/vite/tar）#116
Merged
Conversation
npm audit fix（非 --force）仅应用上游父依赖已允许的兼容升级：undici 6.27.0 （直接，修 6.x 告警）+ 7.28.0（@electron/get 传递）、vite 7.3.5、tar 7.5.16。 清掉对应 Dependabot 告警（undici/vite/tar）。仅 lockfile 变更。 余下 dompurify(monaco) / form-data+tmp(nx) / js-yaml(gray-matter) / esbuild(vite 锁 ^0.27) 均无兼容上游修复（仅 major 父升级可解），按既定规则暂不强升、保留告警。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
litellm 对未进本地 model_cost 表的新模型（如 claude-opus-4-8）在 cost/token 计量里 get_llm_provider 解析失败时，会先把红字「Provider List: …」print 到 stdout 再抛错 （错误被上游吞掉、不影响结果）；编排 chat 通道以子进程 stdout 作模型回复，该 print 漏进了 评审总结正文。patch 时置 litellm.suppress_debug_info=True 关掉这些 print（正是该段的开关）， 全局生效、与版本无关，放在版本守卫/CLI 分支之前。docs/arch/04 同步说明。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
处理 GitHub Dependabot 告警（security/dependabot）。
规则
只升级我们直接声明的依赖、或上游父依赖已允许的兼容（非破坏性）版本；传递依赖若上游未发布兼容修复，不用
overrides强行改写，保留告警待上游更新（必要时 dismiss）。npm audit fix（非--force）即此规则的工具化。改动（仅 lockfile）
npm audit fix（非--force）应用的兼容安全补丁：<=6.26.0）<7.28.0，high）暂不处理（无兼容上游修复，仅 major 父升级可解 → 按规则保留）
详见下方「剩余告警清单」。均为 dev / 构建期或沙箱渲染层的传递依赖，待上游发布兼容修复后再随父升级。
测试
lint / typecheck / test / build 四关通过。
🤖 Generated with Claude Code