[jariy17]

Description

bun run audit exits 1 on refactor, failing the bun audit gate in .github/workflows/verify.yml:

$ bun audit --ignore GHSA-vfj7-8cjw-p6xm
vite@8.3.0
  vitest > @vitest/mocker > vite
  moderate: launch-editor: escapeCmdArgs() omits % escaping on Windows (>=8.3.0 <=8.3.2) - https://github.com/advisories/GHSA-698v-4r3x-3vcv

1 vulnerability (1 moderate)
error: script "audit" exited with code 1

bun update vite takes it 8.3.0 -> 8.3.4. The advisory caps at 8.3.2, and vitest@4.1.11 already declares vite: ^6.0.0 || ^7.0.0 || ^8.0.0, so 8.3.4 resolves inside the existing range.

Lockfile only — bun.lock, +20/-20. package.json is unchanged. No new --ignore entry, because the advisory is actually resolved rather than suppressed.

Impact of the advisory itself

Low. vite is a transitive dev-only dependency that backs the e2e runner in vitest.e2e.config.ts. It is not in the published npm bundle. The practical cost was a red required check on every PR.

Related Issue

Documentation PR

Not applicable — no user-facing behavior or documented surface changes.

Type of Change

• Other: dependency bump to clear a security advisory

Testing

• I ran bun test — 4705 pass, 0 fail, 311 files
• I ran the relevant end-to-end tests with bun run test:e2e, or explained why they are not applicable — did not run against live AWS, but since this bumps the e2e runner's own vite, I verified collection still works: AGENTCORE_CLI_PATH=... bunx vitest list --config vitest.e2e.config.ts enumerates all 24 e2e tests under 8.3.4
• I ran bun run typecheck
• I ran bun run lint:check
• I ran bun run format:check
• I ran bun run build
• If I modified src/assets/, I updated affected snapshots — src/assets/ not touched

And the point of the change:

• bun run audit — No vulnerabilities found (checked 798 packages, 1 ignored)

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works — a lockfile bump has no test surface; bun audit in verify.yml is the regression check
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

This PR is a lockfile-only update (bun.lock) bumping patch versions of transitive dev dependencies pulled in via vitest:

• vite 8.3.0 → 8.3.4
• rolldown 1.2.9 → 1.2.14 (and all its platform bindings)
• postcss 8.5.28 → 8.5.31
• nanoid 3.3.19 → 3.3.20
• @oxc-project/types 0.150.0 → 0.154.0

No package.json changes, no source changes, and no changes to runtime dependencies — these only affect the test toolchain. Nothing to flag re: mocking or telemetry since no behavior changed. Assuming CI (tests + bundle build) is green, this is safe to merge.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.61%. Comparing base (d7b4d4a) to head (8ce0b09).
⚠️ Report is 1 commits behind head on refactor.

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2634      +/-   ##
============================================
- Coverage     96.62%   96.61%   -0.01%     
============================================
  Files           706      706              
  Lines         58502    58460      -42     
============================================
- Hits          56527    56484      -43     
- Misses         1975     1976       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.