[chappie-daemon]

What

Closes the 41 in-scope Dependabot alerts (axios ×12, stream-json ×6, js-yaml ×10, fast-uri ×7, brace-expansion ×4, proxy-addr ×1, ip ×1):

• axios ^1.18.0 → ^1.20.0
• stream-json ^2.1.0 → ^3.7.0, with the v3 import-shape fix in src/services/event-import-service.ts (v3 is ESM; require() returns the namespace, so the streamer reaches through .default — the withParserAsStream() call site is untouched)
• js-yaml direct pin 4.2.0 → 4.3.2 (closes the 4.x chain), transitive 3.x via override >=3.15.2 <4
• overrides added: proxy-addr >=2.0.8, fast-uri >=3.1.7, brace-expansion >=1.1.21 <2 and >=2.0.0 <2.1.7 (the 2.x selector is deliberately range-bounded — the naive <2.1.7 selector hijacks minimatch 3's ^1.1.7 under the pinned pnpm 10.33.0, measured; the shipped selector resolves both chains at their floors with unchanged vulnerable-range coverage)
• hero-animation (own package, own lock): ip@<=2.0.1 stubbed to @stdlib/utils-noop@^0.2.3 — no patched ip exists, and werift (its only consumer) is never loaded at runtime
• changeset nostream: patch

Verification

Built through a review-gated pipeline (recon → spec → build → planned lenses → approver):

• pnpm run lint (505 files), build:check, test:unit 2340 passing, test:cli 105 passing — all green on the branch
• lockfile greps confirm exact resolved versions; frozen-lockfile install green; hero-animation typecheck green
• security lens: all 10 new integrity hashes match the npm registry byte-for-byte; the ip stub cannot load in any runtime path (werift only imported by webrtc modules node-av never loads); no check-weakening edits
• sprintf-js [BUG]  #232 stays open as scoped (no patched release exists; expected in the regenerated lock)

Post-merge

Dependabot's rescan should close all 41 in-scope alerts (incl. #233) — that is the job's deciding oracle.

[changeset-bot]

🦋 Changeset detected

Latest commit: 85ba8c8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	stream-json@​2.1.0 ⏵ 3.7.0		+4		+2
	axios@​1.18.0 ⏵ 1.20.0	+1	+70
	js-yaml@​4.2.0 ⏵ 4.3.2		+31	+1

View full report

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new blocking issue was established.

Summary

Updates dependencies and lockfiles to address Dependabot alerts.

• The relay installs updated packages and reads streamed imports through the new export shape.
• Manual website deploys run only when the selected branch is main.
• Hero animation installs a no-op package instead of the vulnerable ip package.

No new actionable issues were established. Dependency source files were unavailable, so their exports and behavior were not independently verified.

_{Reviews (2) · Last reviewed commit: "ci(website): keep manual deploys main-on..." · Reviewed by Greptile}

[coveralls]

Coverage Report for CI Build 38842795104

Warning

No base build found for commit 3877140 on main.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 74.51%

Details

• Patch coverage: 2 of 2 lines across 1 file are fully covered (100%).

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	10510
Covered Lines:	8211
Line Coverage:	78.13%
Relevant Branches:	5461
Covered Branches:	3689
Branch Coverage:	67.55%
Branches in Coverage %:	Yes
Coverage Strength:	854.22 hits per line

---

💛 - Coveralls