Reasoned audit of the 8 open PRs (3 user drafts + 5 Dependabot), the 2
open Dependabot security alerts on `webview/pnpm-lock.yaml`, the 6
stashes on the main checkout, and the 9 sibling agent worktrees.
Key finding: PR #145 (vite 8.0.10 → 8.0.12) only partially closes the
two security alerts. It upgrades the vite+esbuild resolution chain for
`packages/hud` to patched versions (vite 7.3.3 / 8.0.12 + esbuild
0.27.7), but the workspace root (`.`) and `packages/bus` still pin
`vitest: ^2.1.0` → vitest@2.1.9 → vite@5.4.21 → esbuild@0.21.5, which
remains vulnerable. The recommended morning sequence merges PR #145
first, then adds a `pnpm.overrides` block to close the residue
without forcing a major vitest bump in v0.1.
Read-only — no code or dependency changes in this commit; just the
report and the recommendation tree for the morning.
Refs #87 (PTT WizardState in stash@{0} flagged for owner)
Refs #58 (Ollama baseline drift noted out-of-scope)
Triage of 5 open Dependabot PRs, 2 moderate CVE advisories, and 5
accumulated stashes from concurrent-agent work earlier in the day.
Recommendations only — no merges, no stash drops executed.
Findings:
- 4 of 5 Dependabot PRs SAFE-MERGE (#144, #145, #147, #148). Verified
in isolated worktrees: pnpm install + bus build + hud test (97/97) +
hud build all pass.
- 1 Dependabot PR NEEDS-INVESTIGATION: #146 (TypeScript 5.9.3 → 6.0.3)
fails typecheck with 3× TS18048 at SegmentedRing.tsx:92 due to TS 6's
stricter indexed-access narrowing. Mechanical fix needed.
- Both moderate CVEs (esbuild GHSA-67mh-4wv8-2f99, vite
GHSA-4w7w-66w2-5vf9) trace to one transitive chain: vitest@2/3 →
vite@5.4.21 → esbuild@0.21.5. Not covered by any open Dependabot PR.
Single remediation: bump vitest to 4.x. Dev-tooling exposure only.
- 4 of 5 stashes DROP (already on develop). 1 PRESERVE-AS-BRANCH
(stash@{3} salvageable Voice Log menu plumbing for v1.1 milestone).
james.maes