René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Remediate OSV lockfile vulnerabilities before first release","articleBody":"## Summary\n\nOSV scanning currently blocks a real MendCode release because the checked-in lockfiles contain vulnerable dependency versions.\n\nLocal command run from `/Users/obed/Code/MendCode`:\n\n```bash\ndocker run --rm -v \"$PWD:/src\" \\\n  ghcr.io/google/osv-scanner:v2.3.8@sha256:64e86bec6df2466feea5137fc7c78fb3b7c21ec077f014d7130f64810e50676b \\\n  scan --recursive /src/src/mendcode\n```\n\nResult on 2026-06-13:\n\n- 70 packages affected\n- 247 known vulnerabilities\n- 5 critical, 85 high, 136 medium, 21 low\n- 246 vulnerabilities report fixed versions\n- affected lockfiles: `src/mendcode/bun.lock`, `src/mendcode/sdks/vscode/bun.lock`\n\nExamples seen in output: `protobufjs`, `shell-quote`, `turbo`, `vite`, `undici`, `wrangler`, `esbuild`, `minimatch`, `serialize-javascript`, `hono`, `axios`, `astro`.\n\n## Release impact\n\nPR #54 adds a release workflow that runs OSV before dependency install and before publishing. That means release infrastructure can merge, but no public release should be published until this issue is closed.\n\n## Acceptance criteria\n\n- Regenerate lockfiles through the approved dependency workflow.\n- Do not hand-edit lockfile versions.\n- Run OSV and get a clean result, or document explicit accepted residual risk with maintainer sign-off.\n- Run the release workflow in `dry_run=true` after remediation.\n- Only publish a real GitHub Release after the OSV release gate passes.\n","author":{"url":"https://github.com/Obed0101","@type":"Person","name":"Obed0101"},"datePublished":"2026-06-13T02:05:52.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/55/MendCode/issues/55"}