[mtrezza]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

Closes #3445

Approach

Bumps the transitive dev dependency @humanfs/node from 0.16.6 to 0.16.8 (lock file only). It is pulled in only by eslint@9.39.2, whose range ^0.16.6 already allows 0.16.8. This resolves the open medium-severity Dependabot alert for @humanfs/node (GHSA-p498-v437-472g, vulnerable range < 0.16.8).

The lock file also picks up the new version's own dependencies: @humanfs/core 0.19.1 → 0.19.2, the new types-only package @humanfs/types 0.15.0, and @humanwhocodes/retry ^0.4.0, which the already hoisted @humanwhocodes/retry@0.4.2 satisfies, so the nested @humanwhocodes/retry@0.3.1 copy is removed.

Changes

• @humanfs/node 0.16.7: Added directory to the repository field in package.json
• @humanfs/node 0.16.8: Security fix for GHSA-p498-v437-472g: copy() and copyAll() now recreate symlinks instead of copying the contents of their targets. @humanfs/types is now a runtime dependency (Bug: HfsWalkEntry type missing since @humanfs/types is a devDependency humanwhocodes/humanfs#145), and @humanwhocodes/retry goes from ^0.3.0 to ^0.4.0
• @humanfs/core 0.19.2: @humanfs/types is now a runtime dependency (Bug: HfsWalkEntry type missing since @humanfs/types is a devDependency humanwhocodes/humanfs#145)

Breaking Changes

None

Code Changes Required

None. The upgrade is a drop-in replacement. eslint only uses hfs.isDirectory() and hfs.walk() from @humanfs/node, which did not change. The only source change affects copy() and copyAll(), which eslint does not use.

Tasks

None. This PR only changes the lock file.

Summary by CodeRabbit

• Chores
  • Updated project package metadata and supporting components. No user-facing functionality changes are included in this update.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 632b5e42-1f1e-45d6-824f-1cbe9bbfb7be

📥 Commits

Reviewing files that changed from the base of the PR and between 8664ed0 and e55924b.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The lockfile updates @humanfs/core to 0.19.2 and @humanfs/node to 0.16.8. It also updates their dependency entries and removes a nested @humanwhocodes/retry 0.3.1 entry.

Changes

HumanFS dependency update

Layer / File(s)	Summary
Update HumanFS lockfile dependencies package-lock.json	The lockfile records the updated HumanFS versions, resolved URLs, integrity hashes, license, and dependencies. It removes the nested @humanwhocodes/retry 0.3.1 entry.

Estimated code review effort: 2 (Simple) | ~8 minutes

Merge Risk: ⚪ Minimal · up to e5592

No actionable merge-blocking risk is evident from this dependency update; it is mergeable after normal checks.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Engage In Review Feedback	❓ Inconclusive	The supplied review result reports zero actionable findings for the current review. The reviewed range contains only a lockfile change and no review-thread metadata. The supplied result explicitly doe…	Provide the complete review-thread history, including earlier comments and their discussion states. For each feedback comment, verify prior discussion followed by either an implementing commit or reviewer retraction/acceptance of the author…

✅ Passed checks (6 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses the allowed refactor: prefix, starts the description with a capitalized letter, and accurately identifies the dependency version bump.
Description check	✅ Passed	The description includes all required sections and clearly documents the issue, lockfile-only approach, dependency changes, security rationale, breaking-change status, and task status.
Linked Issues check	✅ Passed	Issue #3445 requests the dependency upgrade from @humanfs/node 0.16.6 to 0.16.8. The PR summary reports that package-lock.json makes this exact change. It also updates the required @humanfs/core depen…
Out of Scope Changes check	✅ Passed	The reported changes are limited to package-lock.json. The @humanfs/core update, @humanfs/types entry, and removal of the redundant nested retry copy support the @humanfs/node upgrade. No unrelated so…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Security Check	✅ Passed	PASS. The reviewed range changes only package-lock.json. It upgrades the dev-only transitive dependency @humanfs/node from 0.16.6 to 0.16.8, updates @humanfs/core, adds the integrity-pinned @humanfs/t…

Full details: Engage In Review Feedback

Explanation

The supplied review result reports zero actionable findings for the current review. The reviewed range contains only a lockfile change and no review-thread metadata. The supplied result explicitly does not establish whether earlier posted feedback exists or was resolved, so this check cannot verify engagement with all feedback comments.

Resolution

Provide the complete review-thread history, including earlier comments and their discussion states. For each feedback comment, verify prior discussion followed by either an implementing commit or reviewer retraction/acceptance of the author’s position.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[parseplatformorg]

🎉 This change has been released in version 9.3.0-alpha.9