3 people b0738a8e06 Oracle fixtures: move the astro pins past the open advisories (#727) ...

Dependabot has 16 open alerts on main, all of them the astro ^5.0.0 pin
in two oracle workspace fixtures. Both files move to ^7.1.0, which clears
every advisory's first-patched version (the highest is 7.1.0 for
GHSA-4g3v-8h47-v7g6).

These are test fixtures, not shipped code. Nothing a user installs reads
them: the oracle stages the workspace tree as plain files and never runs
a package install, and the engine's astro detection keys on the presence
of the dependency, not its version. The live-e2e astro fixture is a
separate tree and already pins ^7.1.0, so it is untouched.

Verified with the oracle replay (zero unreviewed differences, so no
golden moved and DELTAS.md gains no entry), plus bun run build and the
default suite with IMPECCABLE_BIN set.


Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY

Co-authored-by: Claude Code <noreply@anthropic.com>

2026-09-04 12:30:20 -07:00

..

apps

Oracle fixtures: move the astro pins past the open advisories (#727)

2026-09-04 12:30:20 -07:00

DESIGN.md

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

package.json

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00

PRODUCT.md

The Rust engine: one binary replaces every script and the JS detector, fully open (#714)

2026-09-04 10:42:45 -07:00