Skip to content

Rebuild root lockfile to restore deterministic npm audit scanning - #13

Open
Pmaster-dev with Copilot wants to merge 4 commits into
developfrom
copilot/audit-needs-teardown
Open

Rebuild root lockfile to restore deterministic npm audit scanning#13
Pmaster-dev with Copilot wants to merge 4 commits into
developfrom
copilot/audit-needs-teardown

Conversation

Copilot AI commented Jul 14, 2026

Copy link
Copy Markdown

npm audit was failing before vulnerability evaluation due to a corrupted lockfile state (Cannot read properties of undefined (reading 'extraneous')). This change rebuilds the lock graph so audit can execute normally and produce real findings for triage.

  • Lockfile recovery

    • Replaced the root package-lock.json with a freshly generated workspace-resolved lockfile.
    • Removed inconsistent virtual-tree metadata that was causing Arborist to crash during audit/--package-lock-only operations.
  • Audit path normalization

    • Restored the expected workflow: dependency graph resolution succeeds first, then advisory scanning runs and returns actionable CVEs instead of terminating on lockfile parsing.
# Previous failure mode
npm audit
# -> Cannot read properties of undefined (reading 'extraneous')

# After this change
npm audit
# -> completes and reports vulnerabilities for remediation

Comment thread scripts/generate-sdk.js Fixed
…from environment values'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Pmaster-dev <8pinkycollie8@gmail.com>
@Pmaster-dev
Pmaster-dev marked this pull request as ready for review July 20, 2026 15:06
@Pmaster-dev

Copy link
Copy Markdown
Owner

@copilot please fix the merge conflicts in this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants