Confirmed finding
The current lockfile resolves the direct development dependencies vitest@2.1.9 and @vitest/coverage-v8@2.1.9, with vite@5.4.21.
Two independent lockfile-aware checks on commit 137621f1a64d2351728f81278836b16274199d81 reported the same dependency graph:
npm audit --audit-level=highnpx -y @claude-flow/cli@3.25.6 security scan --target . --depth deep --type all
Observed aggregate: 2 critical, 1 high, 3 moderate, 2 low dependency signals. The direct critical path is Vitest UI, GHSA-5xrq-8626-4rwp, patched in 3.2.6 and 4.1.0. The transitive high path is Vite, GHSA-fx2h-pf6j-xcff, patched in 6.4.3, 7.3.5, and 8.0.16.
Lockfile SHA-256: f26d2be9956e7a88b2d9296f08d1cad183c47e81f41fb360e28bd0592fe19064.
Reachability and severity
The repository scripts use vitest run and vitest; they do not currently expose Vitest UI or a Vite development server. Therefore the published network attack paths are not confirmed in normal CI or package runtime. Risk is concentrated in developer workstations, especially Windows, if UI or development servers are enabled or exposed. No production reachability claim is made.
Official advisories:
Acceptance criteria
- Upgrade Vitest and coverage together to a compatible patched release.
- Resolve Vite to at least the patched line applicable to the chosen Vitest release.
- Regenerate and commit the lockfile.
- Pass
npm ci, build, lint, all tests, coverage, CLI smoke tests, and the no optional dependencies job on Node 18, 20, and 22.
- Re-run both scanners and record zero critical or high dependency findings, or document a confirmed unreachable exception with an expiry date.
- Do not enable or network expose Vitest UI or Vite development servers as part of the remediation.
Baseline
The ECT fail-closed regression branch passed build, lint, and 108 of 108 tests. Secret scanning covered 42 files and found no secrets. This issue is separate from the ECT implementation and should land independently.
Confirmed finding
The current lockfile resolves the direct development dependencies
vitest@2.1.9and@vitest/coverage-v8@2.1.9, withvite@5.4.21.Two independent lockfile-aware checks on commit
137621f1a64d2351728f81278836b16274199d81reported the same dependency graph:npm audit --audit-level=highnpx -y @claude-flow/cli@3.25.6 security scan --target . --depth deep --type allObserved aggregate: 2 critical, 1 high, 3 moderate, 2 low dependency signals. The direct critical path is Vitest UI, GHSA-5xrq-8626-4rwp, patched in 3.2.6 and 4.1.0. The transitive high path is Vite, GHSA-fx2h-pf6j-xcff, patched in 6.4.3, 7.3.5, and 8.0.16.
Lockfile SHA-256:
f26d2be9956e7a88b2d9296f08d1cad183c47e81f41fb360e28bd0592fe19064.Reachability and severity
The repository scripts use
vitest runandvitest; they do not currently expose Vitest UI or a Vite development server. Therefore the published network attack paths are not confirmed in normal CI or package runtime. Risk is concentrated in developer workstations, especially Windows, if UI or development servers are enabled or exposed. No production reachability claim is made.Official advisories:
Acceptance criteria
npm ci, build, lint, all tests, coverage, CLI smoke tests, and the no optional dependencies job on Node 18, 20, and 22.Baseline
The ECT fail-closed regression branch passed build, lint, and 108 of 108 tests. Secret scanning covered 42 files and found no secrets. This issue is separate from the ECT implementation and should land independently.