Repository navigation
Chore: handlebars 4.7.9 to 4.7.10, and the current engineering standard - #33
Merged
Merged
Conversation
Two unrelated small things, batched because a merge costs a deploy. npm audit reported one critical: three JavaScript injection advisories against handlebars 3.0.0 to 4.7.9, reached through auto-changelog, the only entry in devDependencies. Nothing here compiles a template a stranger wrote. handlebars sees auto-changelog's own templates and the tool runs by hand, so the exposure is nil and the fix is a patch bump inside the allowed range. Four lines of package-lock.json, auto-changelog unchanged at 2.7.0, audit to 0, and npm ci installs it with auto-changelog --version still reporting 2.7.0. The engineering standard was behind the canonical copy in Democracy-by-Design, which changed on 19 October. The old copy said to gather a day's work and merge it once or twice; the current one says not to merge on one's own judgement at all, because the owner merges and nothing goes live before 20:00 IST. The old copy also gave the publish window as 07:47 or 19:47 IST, where publish-locked.yml now runs on cron '30 14 * * *', which is 20:00 IST. CLAUDE.md imports that file, so a stale copy is a stale instruction. Suite: 33 tests pass and build_companions.py --check reports companions/ matches archive/. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018ngpxC1PYZGv9QZ2zJEX6A
Naming an advisory in prose failed the spell check. cspell splits on hyphens, so GHSA-8r5x-fm3f-whwj arrives as four tokens and the last one is all letters, which it reads as a misspelling: "CLAUDE.md:124:72 Unknown word (whwj)". The other two ids in the same paragraph passed only because every one of their segments happens to mix digits with letters. Adding the three words would have left the next advisory to fail the same way, so this is a pattern in ignoreRegExpList rather than three more entries in the words list. Verified both ways with cspell 9: without the pattern it reproduces CI's error at the same line and column, with it the file is clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018ngpxC1PYZGv9QZ2zJEX6A
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two unrelated small things, batched because a merge costs a deploy.
The critical
npm auditreported one critical: three JavaScript injection advisories against handlebars 3.0.0 to 4.7.9, reached throughauto-changelog, the only entry indevDependencies.compileNothing here compiles a template a stranger wrote. handlebars sees auto-changelog's own templates, shipped inside that package, and the tool runs by hand through
npm run changelog. So the exposure is nil and the fix is a patch bump inside the allowed range, which is reason enough to take it: handlebars 4.7.9 to 4.7.10, four lines ofpackage-lock.json,auto-changelogunchanged at 2.7.0, audit to 0.npm ciinstalls it andauto-changelog --versionstill reports 2.7.0.The standard
tools/sync-standards.sh --checkin Democracy-by-Design reported this clone behind the canonical copy, which changed on 19 October. Two instructions moved. The old copy said to gather a day's work and merge it once or twice; the current one says not to merge on one's own judgement at all, because the owner merges and nothing goes live before 20:00 IST. The old copy also gave the publish window as 07:47 or 19:47 IST, wherepublish-locked.ymlnow runs oncron '30 14 * * *', which is 20:00 IST.CLAUDE.mdimports that file, so a stale copy is a stale instruction.Verification
33 tests pass, and
scripts/build_companions.py --checkreportsPASS companions/ matches archive/.Generated by Claude Code