From b0738a8e068aeba8d0ea59fd2d6817b79f492ae0 Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Fri, 4 Sep 2026 12:30:20 -0700 Subject: [PATCH] Oracle fixtures: move the astro pins past the open advisories (#727) Dependabot has 16 open alerts on main, all of them the astro ^5.0.0 pin in two oracle workspace fixtures. Both files move to ^7.1.0, which clears every advisory's first-patched version (the highest is 7.1.0 for GHSA-4g3v-8h47-v7g6). These are test fixtures, not shipped code. Nothing a user installs reads them: the oracle stages the workspace tree as plain files and never runs a package install, and the engine's astro detection keys on the presence of the dependency, not its version. The live-e2e astro fixture is a separate tree and already pins ^7.1.0, so it is untouched. Verified with the oracle replay (zero unreviewed differences, so no golden moved and DELTAS.md gains no entry), plus bun run build and the default suite with IMPECCABLE_BIN set. Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY Co-authored-by: Claude Code --- tests/oracle/workspaces/live-astro/package.json | 2 +- tests/oracle/workspaces/live-workspaces/apps/admin/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/oracle/workspaces/live-astro/package.json b/tests/oracle/workspaces/live-astro/package.json index 33a33a0bb..ad25371b4 100644 --- a/tests/oracle/workspaces/live-astro/package.json +++ b/tests/oracle/workspaces/live-astro/package.json @@ -1 +1 @@ -{ "name": "oracle-live-astro", "private": true, "type": "module", "dependencies": { "astro": "^5.0.0" } } +{ "name": "oracle-live-astro", "private": true, "type": "module", "dependencies": { "astro": "^7.1.0" } } diff --git a/tests/oracle/workspaces/live-workspaces/apps/admin/package.json b/tests/oracle/workspaces/live-workspaces/apps/admin/package.json index 7b789eabd..fe5089704 100644 --- a/tests/oracle/workspaces/live-workspaces/apps/admin/package.json +++ b/tests/oracle/workspaces/live-workspaces/apps/admin/package.json @@ -1 +1 @@ -{ "name": "admin", "private": true, "type": "module", "dependencies": { "astro": "^5.0.0" } } +{ "name": "admin", "private": true, "type": "module", "dependencies": { "astro": "^7.1.0" } }