[mtrezza]

Security update for packages bundled inside the npm CLI. npm is a transitive development dependency (lock-file-only change). This PR upgrades only the copy nested under @semantic-release/npm@13.1.5 (node_modules/@semantic-release/npm/node_modules/npm, range ^11.6.2) from 11.20.0 to 11.21.1, the newest 11.x release; npm latest is 12.x, which is outside the range. npm is only used by the release-automated.yml workflow through @semantic-release/npm; it is not part of the SDK build, tests or bundles, and PR CI does not exercise it.

npm 11.21.1 bundles patched versions of brace-expansion (5.0.12), ip-address (10.7.2), postcss-selector-parser (7.1.6) and undici (6.29.0).

Security

Resolved by this PR:

Advisory	Package	Severity	Vulnerable	Before	After
GHSA-q2hr-2g5m-vwhr (CVE-2026-102277)	brace-expansion	medium	>= 4.0.0, < 5.0.12	5.0.9	5.0.12
GHSA-2vr4-cq9g-pvrc (CVE-2026-101910)	ip-address	medium	>= 10.2.0, <= 10.5.0	10.5.0	10.7.2
GHSA-r53p-7pc4-xj5r (CVE-2026-18540)	undici	low	< 6.28.1	6.28.0	6.29.0

Fixed in the nested npm 11 copy only. These alerts stay open because the second npm copy (see below) still bundles a vulnerable version:

Advisory	Package	Severity	Vulnerable	Nested npm 11 copy (this PR)	Root npm 10.9.9 copy (unchanged)
GHSA-j6r3-76f7-8jcv (CVE-2026-101912)	ip-address	medium	<= 10.7.0	10.5.0 → 10.7.2	10.1.0
GHSA-rpw4-54j3-4h4q (CVE-2026-101913)	ip-address	medium	<= 10.5.0	10.5.0 → 10.7.2	10.1.0
GHSA-rj75-hqrm-r3gf (CVE-2026-104844)	postcss-selector-parser	medium	< 7.1.6	7.1.4 → 7.1.6	7.1.1

The second copy, node_modules/npm@10.9.9, is required by @semantic-release/npm@11.0.3 (range ^10.5.0), which comes from the nested semantic-release@22.0.12 of @saithodev/semantic-release-backmerge@4.0.1. 10.9.9 is already the newest 10.x release, so its bundled ip-address 10.1.0 and postcss-selector-parser 7.1.1 cannot be updated through a regular dependency update. This PR leaves that copy unchanged.

Changes

• 11.21.0: npm dist-tag supports OIDC authentication (feat(dist-tag): support OIDC authentication npm/cli#10056); npm stage documentation update (docs: update npm stage docs to reflect that it can create new packages npm/cli#10050); bundled @npmcli/config 10.14.0
• 11.21.1: Fixed writing registry allowScripts keys under install-strategy=linked (fix: write registry allowScripts keys under install-strategy=linked npm/cli#10059); bundled dependencies updated to brace-expansion 5.0.12, ip-address 10.7.2, postcss-selector-parser 7.1.6, undici 6.29.0 and http-cache-semantics 4.3.0 (deps: resolve production audit vulnerabilities npm/cli#10089); bundled workspace packages @npmcli/arborist 9.9.3, libnpmdiff 8.1.14, libnpmexec 10.3.4, libnpmfund 7.0.28 and libnpmpack 9.1.15

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement.

Verified against this repository's release workflow:

• @semantic-release/npm 13.1.5 runs npm version, npm pack, npm whoami, npm publish and npm dist-tag add. None of them changed in 11.21.0 or 11.21.1 for token authentication.
• The OIDC token exchange that 11.21.0 adds to npm dist-tag (and refactors for npm publish) only runs when the CI environment provides an OIDC token, and it never throws. The release job in release-automated.yml does not grant id-token: write and authenticates with NPM_TOKEN; the most recent release run that published (8.6.2-alpha.1) logs "Retrieval of GitHub Actions OIDC token failed" followed by "Wrote NPM_TOKEN to .npmrc". Publishing and dist-tag handling are therefore unchanged. Provenance is not configured.
• The engines field of npm (^20.17.0 || >=22.9.0) is identical in 11.20.0 and 11.21.1. The release job uses Node latest, and the CI matrix (20.19.0, 22.13.0, 24.1.0) is also within the range.

The lock file diff is limited to the nested npm entry (version, resolved URL, integrity and dependency ranges) and its bundled entries, in both the packages and the legacy dependencies sections of the lockfile. All 143 bundled entries match the contents of the published npm-11.21.1.tgz, whose integrity matches the registry.

Summary by CodeRabbit

• Chores
  • Updated the bundled npm tooling to a newer version and refreshed its included package records. No user-facing features or behavior changes are noted in this update.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 8690efaa-a5d4-47e1-877f-2b537fa401cf

📥 Commits

Reviewing files that changed from the base of the PR and between eda6074 and 52a86c1.

📒 Files selected for processing: 1

• package-lock.json

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The lockfile updates npm bundled under @semantic-release/npm from 11.20.0 to 11.21.1. It also updates related bundled dependency ranges and package records in both lockfile representations.

Changes: npm Lockfile Update

Layer / File(s)	Summary
Update npm and bundled dependencies package-lock.json	The lockfile updates npm to 11.21.1 and records newer versions of bundled dependencies, including Arborist, config, npm libraries, and utilities. These updates appear in both lockfile representations.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: semantic-release-bot

Merge Risk: ⚪ Minimal · up to 52a86

This lockfile update does not introduce an identified compatibility regression. It is mergeable with normal checks.

Pre-merge checks: 7

Check name	Status	Explanation
Title check		The title uses the allowed refactor: prefix, capitalizes the first word after the prefix, and accurately describes the npm dependency update.
Description check		The description is detailed and directly explains the security update, affected dependency copies, remaining vulnerabilities, workflow impact, verification, and lockfile scope. It does not use the tem…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		PASS — The PR changes only package-lock.json. All 12 changed package records belong to the development-only nested npm copy under @semantic-release/npm. The update moves npm 11.20.0 to 11.21.1 and upd…
Engage In Review Feedback		No review feedback comments or actionable findings were supplied. Therefore, there was no feedback for the contributor to engage with, implement, or discuss.

Full details: Description check

Explanation

The description is detailed and directly explains the security update, affected dependency copies, remaining vulnerabilities, workflow impact, verification, and lockfile scope. It does not use the template headings or task checkboxes, but the required information is mostly present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Security Check

Explanation

PASS — The PR changes only package-lock.json. All 12 changed package records belong to the development-only nested npm copy under @semantic-release/npm. The update moves npm 11.20.0 to 11.21.1 and updates bundled dependencies associated with the advisories listed in the PR. No application code, workflow code, URLs outside the npm registry, or executable security-sensitive patterns changed. The separate root npm 10.9.9 copy remains unchanged, so its existing advisories are not introduced by this PR.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.98%. Comparing base (eda6074) to head (52a86c1).

Additional details and impacted files

@@           Coverage Diff           @@
##            alpha    #3157   +/-   ##
=======================================
  Coverage   99.98%   99.98%           
=======================================
  Files          64       64           
  Lines        6339     6339           
  Branches     1522     1526    +4     
=======================================
  Hits         6338     6338           
  Misses          1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.