Commit Graph
109 Commits
Author SHA1 Message Date
weichenandCursor f9d7bbe9f2 Pin backend to the final-turn result checks
Why: Direct runs now check artifacts and run a fail-closed verifier before they stop. The Dev checkout has to build that backend.
Evidence: Backend a3ae1b9; go test ./... passed in that checkout. agent-native gitlinks stay a34689c.
Impact: Only modules/backend moves. Squad and the three agent-native pins stay put.
Refs: feature/agent-harness-p2
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 13:54:24 +00:00
weichenandCursor b7631c71a8 Pin the harness turn loop across the three native checkouts
Why: the direct chat path and both consumers must compile the same agent-native commit, or the new loop fields exist in only one replace target.
Evidence: make test passed (boundaries, core, backend, frontend 51, ui 71, agent-command). The three agent-native gitlinks are a34689c.
Impact: Dev pins deps/agent-native, deps/agent-squad, and modules/backend. Squad behavior stays on the zero-value kernel switches.
Refs: feature/agent-harness-p1
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 13:29:55 +00:00
weichenandCursor 897d12d6b5 Pin the harness proposal and native tool-call replay
Why: The model imitated flattened tool-call text and invented artifact ids. P0 stops that replay, and the proposal records the harness work that still sits in later phases.
Evidence: Documents PR 32 and Backend PR 42. Backend go test ./... passed. Dev make test passed (boundaries, core, backend, frontend 51, ui 71, agent-command).
Impact: Gitlinks move to feature/agent-harness-p0 on documents (a3f0b80) and backend (188c633). No other submodule changes. P1-P4 are not implemented.
Refs: feature/agent-harness-p0
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 12:31:27 +00:00
weichen 6d496139b4 Merge remote-tracking branch 'origin/main' into feature/base-extension-roadmap
Co-authored-by: Cursor <cursoragent@cursor.com>

# Conflicts:
#	modules/backend
2026-10-01 10:36:41 +00:00
weichenandCursor 09964e522b Pin the extension roadmap and downstream spike
Why: Downstream products need a published extension surface, contract checks, and a sample plugin that does not modify the base.
Evidence: scripts/lint-boundaries.sh printed boundaries ok. examples/downstream-rdm go test passed. Submodule pointers record the core, documents, backend, ui, and frontend commits for this roadmap.
Impact: make test runs the boundary lint first. make plugin-new scaffolds a declaration plugin. Version tags and remote downstream repositories are not created.
Refs: .task/feature-base-extension-roadmap.md
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 10:35:15 +00:00
weichenandCursor 7ec2b3c2b8 Pin the headless runtime and the orchestration platform
ci / test (pull_request) Failing after 1m38s
Why: Dev has to record the library commits the product now builds against.
Evidence: make test
Impact: runtime.entry stays direct. This commit only moves gitlinks.
Refs: feature/native-squad-full-upgrade
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 10:33:03 +00:00
weichenandCursor 37de7c4ff1 Pin the quality system and the squad entry
ci / test (pull_request) Failing after 1m37s
Why: The product needs the new content rules and the optional squad entry, while the library pins must match the kernel and router those paths compile against.
Evidence: Backend go test ./... -count=1 passed on 268f4a9. runtime.entry stays direct because no paired live scores exist.
Impact: Dev now points at the quality and squad-entry backend, agent-native cfc840c, and agent-squad d38f838. make eval-deliverables runs the scorecard tests.
Refs: deliverable-quality-system
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 09:35:06 +00:00
weichenandCursor f41ad95b1c Advance the backend gitlink to the professional-standards merge
Why: The deliverable standards landed in Agent-System-Backend and were
merged, so the Dev pin has to move to that commit before this branch
can be reviewed.

Evidence: Backend PR #38 merged as 2079b2dfa851bd4cbe8f399a015126c842c441ec.
make test passed on this worktree before the pin move; the pin itself
does not change Dev source.

Impact: modules/backend now points at the merged standards. No other
submodule moved.

Refs: feature/agent-professional-deliverables
https: //git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/pulls/38
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 08:20:16 +00:00
weichenandCursor 7acca87314 Merge origin/main into the chat timeline branch
ci / test (pull_request) Failing after 1m37s
Why: Main moved the backend pin to the B10 assembly after this branch
was opened, so the Dev pin has to follow the merged backend branch.

Evidence: modules/backend is b1fa89b, which contains origin/main and
the timeline changes. No other path conflicted.

Impact: This branch contains current main. The backend gitlink is the
merged feature tip.

Refs: feature/chat-timeline-preview
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 07:40:42 +00:00
weichen 6b33db196c Point backend at the completed B10 assembly
ci / test (pull_request) Failing after 17m15s
Why: Backend PR #36 closes the three open B10 sub-items (MCP config
injection, subagent bridge, explicit roles, skill-borne recipes); the
parent repo pins the new backend head.

Evidence: backend go vet + go test 21 packages ok; Dev make test all
green (core + backend 21 + frontend 42 + ui 68 + agent-command);
task card filled with per-item evidence.

Impact: modules/backend gitlink bump only; task card updated.

Refs: .task/feature-full-agent-b10-r2.md; Backend PR #36.
2026-10-01 06:20:35 +00:00
weichenandCursor 3575702163 Merge origin/main into the chat timeline branch
Why: Acceptance has to include the latest main, including the
agent-native kernel pin that landed in backend.

Evidence: Backend merge ca8aa5d contains both parents. go test passed
for runtime, tools, and squadadapter.

Impact: This branch now contains origin/main. The backend feature
branch includes that kernel pin.

Refs: feature/chat-timeline-preview
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 06:18:26 +00:00
weichenandCursor 3838274159 Pin the chat timeline and move preview into its own pane
Why: The design system still described preview as a right-rail tab,
while the implementation now keeps a timeline in the transcript and
opens files in a closable pane beside the chat.

Evidence: make test passed (core, backend, frontend 51, ui 71, agent-command).

Impact: Dev pins core d437530, backend dab8f31, ui 8bfe8a8, frontend 0ed8ad3.
DESIGN.md §6, §9.3, and §9.6 match that layout.

Refs: feature/chat-timeline-preview
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 06:16:51 +00:00
weichen 916437ca2d Merge remote-tracking branch 'origin/main' into feature/full-agent-r1 2026-10-01 06:09:46 +00:00
weichen c9221faedc Land the full-agent capability batch across agent-native, agent-squad, and backend
ci / test (pull_request) Failing after 1m54s
Why: the settled direction requires a complete agent kernel (web
search, code tooling, system tools, external tool calls, skills,
prompts) fused with squad orchestration; the three sub-repos landed
their batches and this bumps the gitlinks and records the task card.

Evidence: Agent-Native PR #3 (go vet + go test 15 pkgs ok), Agent-Squad
PR #3 (6 pkgs ok), Backend PR #35 (19 pkgs ok after rebasing onto the
concurrently merged #34); Dev make test all green (core + backend 19 +
frontend vitest 40 + ui vitest 68 + agent-command).

Impact: deps/agent-native -> f9ab2ef, deps/agent-squad -> 9a402e4,
modules/backend -> 87a3d0d; task card filled with per-PR evidence and
remaining-item notes (sandbox honesty, injection surfaces,
progressive enablement, deployment validation pending).

Refs: .task/feature-full-agent-r1.md batches B1-B10.
2026-10-01 06:08:51 +00:00
weichen 427263cee5 Merge remote-tracking branch 'origin/main' into fix/empty-create-task
Co-authored-by: Cursor <cursoragent@cursor.com>

# Conflicts:
#	.task/feature-duplication-lesson-records.md
2026-10-01 05:29:27 +00:00
weichenandCursor 782e4fdb56 Point frontend at the merged empty-workspace fix
Why: The empty-create branch was synced onto frontend main after the input queue landed, so the parent gitlink must follow that tip.
Evidence: The synced tip 0cc0f40 is on frontend main, and vitest reported 42 passed with the default-project path still present.
Impact: Dev gitlink only.
Refs: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Frontend/pulls/29
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 05:28:52 +00:00
weichen e7140825d8 Merge remote-tracking branch 'origin/main' into feature/input-queue
Co-authored-by: Cursor <cursoragent@cursor.com>

# Conflicts:
#	.task/feature-duplication-lesson-records.md
2026-10-01 05:27:25 +00:00
weichenandCursor aae0efee1a Point frontend at the merged input queue
Why: The input-queue branch was synced onto frontend main after the preview fallback landed, so the parent gitlink must follow that tip.
Evidence: Frontend main ba52fad contains aad5871, and vitest reported 42 passed on that tip.
Impact: Dev gitlink only. The queue and files tab stay, and the preview sniff changes remain in the pinned tree.
Refs: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Frontend/pulls/28
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 05:26:40 +00:00
weichen 46f89cf921 Merge remote-tracking branch 'origin/main' into feature/binary-doc-index 2026-10-01 05:25:41 +00:00
weichenandCursor c4cf7af296 Point backend at the merged binary-doc index
Why: The index branch was synced onto backend main after the interpreter merge, so the parent gitlink must follow that tip.
Evidence: Backend main 42fe619 contains 34be855, and go test of tools and runmgr passed on that tip.
Impact: Dev gitlink only. The write guard and text index stay, and the interpreter files remain in the pinned tree.
Refs: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/pulls/34
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 05:25:35 +00:00
weichen 62d39037af Merge remote-tracking branch 'origin/main' into feature/preview-sniff-fallback 2026-10-01 05:20:28 +00:00
weichenandCursor 2192f946a4 Point frontend at the empty-workspace task fix
Why: The first click on 新建任务 did nothing useful when the workspace had no project.
Evidence: Frontend 288d3ac; tsc -b passed and vitest reported 40 passed. A browser check on the dev server created 默认项目 and a conversation on the first click, and a second click added a conversation without a second project.
Impact: Dev gitlink only. Backend is unchanged.
Refs: modules/frontend fix/empty-create-task
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 04:50:21 +00:00
weichenandCursor 30092e300b Point frontend at the input queue and files tab
Why: follow-up messages were rejected while a run was in flight, and
the file list was only available from the workspace overlay.

Evidence: frontend 3c81525; tsc clean; vitest 42 tests.

Impact: gitlink only. Backend conversation serialization is unchanged.

Refs: task feature/input-queue
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 04:31:57 +00:00
weichenandCursor 90a3a1d722 Point backend at binary write guard and text indexing
Why: pseudo-binary Office writes and unsearchable generated documents
were the two pieces of the closed docx PR that main still needs.

Evidence: backend 3e5699c; go test ./... 19 packages ok. Dev #99 and
Backend #27 are closed as superseded.

Impact: gitlink only. Merge after Dev #113 so the refusal text names
tools that are already on main.

Refs: task feature/binary-doc-index
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 04:12:26 +00:00
weichenandCursor a11fed43da Merge origin/main into preview-sniff-fallback
Why: the preview sniff branch predated the shell redesign and could not
merge. Module gitlinks now include current main plus ZIP fallback for
docx, xlsx, and pptx.

Evidence: conflict was only the shared sync-log card; both sides' rows
kept. UI and Frontend tests passed on the updated module SHAs.

Impact: parent branch contains origin/main. .mimosa/ ignore stays.

Refs: task feature/preview-sniff-fallback, Dev PR #96
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 04:07:40 +00:00
weichenandCursor 89481a6ee3 Advance preview sniff gitlinks onto current module mains
Why: the open preview-sniff PRs were cut before the shell redesign, so
they could not merge. UI and Frontend now contain origin/main plus the
ZIP sniff, including xlsx and pptx text fallback.

Evidence: UI vitest 68 and tsc clean; Frontend vitest 40 and tsc clean.
UI pulls/21 and Frontend pulls/22 updated.

Impact: gitlinks only. Dev still needs to merge origin/main before the
parent PR can land.

Refs: task feature/preview-sniff-fallback
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 04:07:21 +00:00
weichenandCursor d62f6806d2 Point backend at run_shell and run_python executors
Why: the deliverable workflow prompts call run_shell and run_python, but
those tools were not in the registered binary, so generation fell back
to text-only write_artifact.

Evidence: backend feature/exec-interpreters 2880b58; go test ./... 19
packages ok in modules/backend.

Impact: Dev gitlink moves to the interpreter commit. Merge the backend
PR before this one so the recorded SHA is on backend main.

Refs: task feature/exec-interpreters
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-01 04:03:07 +00:00
weichen a70242da75 Land agent-native deliverables batch and record the task card 2026-10-01 03:36:18 +00:00
weichen 17b5bbe376 Archive the deliverable-docx-r1 task card and pin frontend head
ci / test (pull_request) Failing after 1m36s
Why: the card was folded into PR #109 already marked complete, so
task-close skipped it; archive it manually per the no-open-cards rule
and advance the frontend gitlink past the mimosa-ignore chore (#26).

Evidence: .task has no deliverable-docx-r1.md left; precheck [cards]
to be re-run after merge; frontend -> de38791 (chore #26 merged).

Impact: housekeeping only; no code paths touched.

Refs: task feature/deliverable-docx-r1 (PR #109), frontend PR #26
2026-10-01 02:54:25 +00:00
weichen d53e8e7c42 Land styled docx generation and in-chat deliverable cards
Why: users received plain-text .docx files and had to dig through the
process collapse or workspace panel to find deliverables; deliverables
must appear directly in the conversation and open with real formatting.

Evidence: module PRs merged — Agent-System-Backend#31 (docgen Markdown
to styled OOXML, write_docx tool, artifact_ref pinned as content after
final text, prompt routing, mock #doc dogfood) and
Agent-System-Frontend#25 (deliverable card renderer, live projection
pinned tail). Combination `make test` green in this worktree: backend
go test 19 pkgs, frontend vitest 40/40 + tsc clean, ui tsc + vitest
68/68 incl design-guard, agent-command ok. Task card records scope,
sync nodes and leftovers.

Impact: gitlinks backend -> 8550bb0, frontend -> b048d90; core/ui
unchanged.

Refs: task feature/deliverable-docx-r1
2026-10-01 02:51:49 +00:00
weichen 6b78db5977 Merge remote-tracking branch 'origin/main' into feature/ui-tokens-v3 2026-09-30 19:31:01 +00:00
weichen b35ea7058f Advance submodule gitlinks to post-merge heads
Why: Submodule branches merged their origin/main (CF3) and were pushed;
record the new heads so the parent sync merges cleanly.
Evidence: submodules green post-merge (ui 68 / frontend 39 tests, tsc
clean); parent task-sync re-run follows this commit.
Impact: gitlinks only.
Refs: task feature/ui-tokens-v3.
2026-09-30 19:30:58 +00:00
weichen c0f0200abd Advance submodule gitlinks: phase 4 chat flow and motion
Why: Land phase 4 of the UI redesign in the parent repo: ToolBlock chat
contract, Collapsible migration of all folds, live sweep with worked-time,
and the honest in-progress input hint. Completes the four-phase plan on
this branch (deviation recorded in the task card).
Evidence: combined make test -> go core/backend/agent-command ok, frontend
39 vitest passed, ui 66 vitest passed; tsc clean in both submodules.
Impact: modules/ui and modules/frontend gitlinks move to their
feature/ui-tokens-v3 heads; task card records results and remaining items.
Refs: task feature/ui-tokens-v3.
2026-09-30 19:26:39 +00:00
weichen 29d24237f3 Pin project-inbox-r1 module combination after module merges
Why: module PRs merged (documents #30, backend #30, ui #22, frontend
#23; core #11/#12 earlier); Dev tracks merged tips.
Evidence: per-module main tips after merge.
Impact: gitlink-only.
2026-09-30 19:19:49 +00:00
weichen d73269e09c Pin project-inbox-r1 module combination (CF3)
Why: CF3 lands across core (project channel helpers), backend
(aggregation/archive/SSE), ui (archive affordance), frontend (dual view).
Evidence: module tests green; combination make test in task card.
Impact: gitlink-only.
2026-09-30 19:16:57 +00:00
weichen f323d3f417 Advance frontend gitlink: artifact preview convergence (phase 3)
Why: Land phase 3 of the UI redesign in the parent repo.
Evidence: frontend submodule commit on feature/ui-tokens-v3; tsc -b and
38 vitest tests pass; task card records the runs.
Impact: modules/frontend gitlink moves; no API changes.
Refs: task feature/ui-tokens-v3.
2026-09-30 19:14:31 +00:00
weichen 05ebf3d9e1 Advance frontend gitlink: admin zone IA (phase 2)
Why: Land phase 2 of the UI redesign in the parent repo: admin-only
full-screen system management, conversation-first sidebar, role-aware
workspace shortcuts.
Evidence: frontend submodule commit on feature/ui-tokens-v3; tsc -b and
38 vitest tests pass in the submodule; combined make test re-run recorded
at phase boundaries in the task card.
Impact: modules/frontend gitlink moves; no API or contract changes.
Refs: task feature/ui-tokens-v3.
2026-09-30 19:11:20 +00:00
weichen 80a4fa5e32 Adopt DESIGN.md constitution and phase-1 Zai visual foundation
Why: The approved frontend redesign requires a durable design constitution
so future UI work stays consistent (user directive: make this project's
standing design guidance, four principles: beautiful/modern/concise/usable).
DESIGN.md encodes the Zai-calibrated rules (surface ladder, type scale,
radius nesting, MotionKit recipes, ToolBlock contract, IA principles) and
AGENTS.md adds a mandatory UI gate; submodules land phase 1 (tokens v3,
MotionKit, Collapsible, panel layout, mono primary buttons).
Evidence: make test in this worktree -> frontend 38 passed (incl. new
host design-guard ratchet), ui 61 passed (incl. collapsible + design-guard),
go core/backend/agent-command ok. precheck READY at R0 0be23f9a4d.
Impact: gitlinks advance to Agent-System-UI/Agent-System-Frontend
feature/ui-tokens-v3 heads; AGENTS.md gains a UI section; no backend or
contract changes.
Refs: session-approved redesign plan v2 (8 decisions recorded in task card).
2026-09-30 19:02:22 +00:00
weichen b8a06cd0e1 Pin artifact-unify-r1 module combination after module merges
Why: backend PR #29 and documents PR #29 merged; Dev tracks merged tips.
Evidence: backend 9f1b964 / documents 6fdfc19.
Impact: gitlink-only.
2026-09-30 18:42:54 +00:00
weichen b10b83456c Pin artifact-unify-r1 module combination (CF-A)
Why: CF-A lands in backend (ctxasm backfill + facade cards) and documents.
Evidence: backend commit recorded in module log; combination make test in
task card.
Impact: gitlink-only.
2026-09-30 18:40:50 +00:00
weichen f96c55df23 Pin card-stream-r1 module combination after module merges
Why: backend PR #28 and documents PR #28 merged; Dev tracks merged tips.
Evidence: backend a067d08 / documents f5aa687.
Impact: gitlink-only.
2026-09-30 18:22:04 +00:00
weichen e1f996815a Pin card-stream-r1 module combination (CF-S: streaming card tools)
Why: CF-S (D44/D45) implementation lands in backend and documents; Dev
tracks the tested combination.
Evidence: backend 24a2873 (tools+cardsvc+runmgr+mock+tests), documents
3d2da4e (usage guide); combination make test recorded in task card.
Impact: gitlink-only on Dev.
Refs: documents 2026-09-30-card-stream-artifact-unify-project-inbox.md (D44/D45).
2026-09-30 18:19:59 +00:00
weichen 0b883469a2 Pin preview-sniff-fallback module combination
Why: track 2 of the fake-docx remediation — read-only preview fallback for
stock text-masquerading docx artifacts; also ignore the Mimosa plugin's
per-session .mimosa state dir that kept dirtying the tree and blocking precheck.

Evidence: modules/ui 83367f7 (doc->binary dispatch + readable Office error),
modules/frontend cd77340 (PK magic sniff + markdown fallback); make test-ui
49/49, make test-frontend 33/33, frontend tsc --noEmit clean.

Impact: parent pins move to the two submodule branches; .gitignore gains
.mimosa/; no code outside those modules.

Refs: .task/feature-preview-sniff-fallback.md
2026-09-30 17:51:53 +00:00
weichen f958bfb326 Pin the preview-capability module combination
ci / test (pull_request) Failing after 1m35s
2026-09-30 17:20:41 +00:00
weichen 792c24f1cc Point the task gitlinks at the preview-capability branches 2026-09-30 17:18:28 +00:00
weichen dcb5bc0f72 Merge remote-tracking branch 'origin/main' into fix/followup-hardening 2026-09-30 17:17:46 +00:00
weichen 1381b826ec Pin backend and core gitlinks and record follow-up hardening
Why: two strands land together — (1) the remaining 20 module-level govulncheck advisories against x/crypto v0.37.0 clear to the upstream floor via Backend#25 (19 fixed, GO-2026-5932 unfixed upstream); (2) backend main (daddac8) and core main (cafd9a5) from the parallel cardflow merge were not yet pinned, and backend main no longer built against the Dev-pinned core — pinning the coherent pair keeps main verifiable.
Evidence: combined make test exit 0 at backend daddac8 + core cafd9a5 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend go test green and govulncheck 0 affected / 0 import-level / 1 module-level; task.sh hardening smoke-verified (drift measurement, identity probe, abandon cleanup all PASS).
Impact: two gitlink pins + task card; no Dev-repo source change; remote branch hygiene (55 merged branches deleted) and global git identity were environment fixes outside the repo.
Refs: .task/fix-followup-hardening.md, Backend PR #25
2026-09-30 17:16:28 +00:00
weichen 9451887c05 Pin cardflow-r1 gitlinks to merged module mains and record PR chain
ci / test (pull_request) Failing after 1m34s
Why: cardflow-r1 组合收尾——五模块 PR 已合入,Dev 指针改钉合入后 main tip(core cafd9a5/documents cb700cf/ui efd87f9/backend 076abfe/frontend 6752b78);任务卡回填 PR 链与自动化缺陷修复记录(死主机 API 基址、compare status 字段不存在)。
Evidence: Dev worktree make test 退出码 0(core/backend ok、frontend 33/33、ui 41/41、agent-command ok)。
Impact: 仅子模块指针 + 任务卡。
Refs: 任务卡 feature/cardflow-r1。
2026-09-30 17:14:33 +00:00
weichen cedf558a18 Merge remote-tracking branch 'origin/main' into feature/cardflow-r1
# Conflicts:
#	modules/backend
#	modules/frontend
#	modules/ui
2026-09-30 17:13:21 +00:00
weichen 641dc6e159 Pin backend, frontend, and ui gitlinks past reachable security advisories
Why: dependency CVE inventory follow-up — backend govulncheck had two reachable vulnerabilities (GO-2026-5004 pgx SQL injection via placeholder confusion, GO-2026-5970 x/text infinite loop via pgx.Connect) and frontend/ui npm audit flagged GHSA-82fw-gwwq-j7x9 (vitest mocker path traversal); all fixed by version bumps merged in the respective repos (Backend#23, Frontend#19, UI#18).
Evidence: gitlinks pinned to backend 41cebd3, frontend af03854, ui daf73be; combined verification make test exit 0 (backend packages ok, frontend 33/33, ui 37/37, agentcmd ok); backend govulncheck now reports 0 reachable (was 2), both frontend repos npm audit clean (was 2 moderate each).
Impact: three gitlink pins + task card only; no Dev-repo source change; vitest stays on 4.1.11 (first fixed release) rather than 5.x.
Refs: .task/fix-dep-vuln-bumps.md
2026-09-30 16:49:56 +00:00