All twelve Dependabot alerts on main were npm transitive dependencies in two
lockfiles, and all were build-time only. Worth saying plainly, because "10
high severity" reads worse than it is: fast-uri, nanoid, postcss, ws and
esbuild are dev dependencies of the webpack and remotion toolchains. Nothing
here reaches a published package.
ClientLib is fixed by a lockfile bump alone. Its dist/*.js is committed and
embedded into the assembly, so the check that matters is whether the shipped
artifact moved: rebuilding with the patched toolchain reproduces all three
files byte for byte, same md5, so it did not.
The readme-video project needed @remotion/cli and remotion moved from 4.0.469
to 4.0.516, which npm audit fix could not do on its own because both are
exact-pinned. The bump is non-major and carries the ws and esbuild fixes.
Both directories now report zero vulnerabilities. Clearing them is mostly
about signal: twelve standing alerts is how a real one goes unnoticed.
e460a12550