[HengYangDS]

Problem and value

Closes #1126. Scope was agreed in #1126 (comment).

The root and renderer development locks retain fast-uri 3.1.8 and 3.1.7, which have published advisories. This updates both to 3.1.9 within the existing override. Only the version, registry URL and integrity change; manifests and other dependencies are unchanged. The distributed Skill excludes these development dependencies.

AI assistance and accountability

Codex (GPT-6; exact model variant unavailable) prepared the two-lock update, rebase and checks under @HengYangDS's direction. The problem was found during dependency inspection.

• @HengYangDS reviewed the final changes and explanation, understands their impact, and can answer questions.

Stability impact

Development dependency maintenance. No renderer, Viewer or schema behavior changes. Existing CLI and generated-output checks cover compatibility; no new test is needed for a lock-only refresh.

Tests run

Current head fa7e352f is rebased onto dev c6b74b5f. The manifests and both lockfiles are byte-identical to the previous qualified head. The new head passes all 19 core tests, generated checks and a byte-identical canonical ZIP rebuild on official Node 22.23.3. Current CI passed all 19 jobs, with two deployments skipped by scope, including webm-decode and webm-artifact, which failed on the previous head before #1304 changed how the WebM gate starts Chrome.

Earlier dependency checks on 3a03f99b, based on dev 63c9263e, used official Node 22.23.3 and npm 10.9.9:

• Frozen installation succeeds for both dependency sets (npm ci --ignore-scripts --no-audit --no-fund and the renderer equivalent).
• Both npm audit --json results report zero vulnerabilities.
• npm test: 19 passed, no failures or skips.
• npm run test:generated: passed; generated files remain unchanged.
• git diff --check: passed.

These are local macOS arm64 checks. Personal review is confirmed. The earlier CI failure from README showcase drift remains recorded at #1247 (comment). That source dependency is now included, and final-head CI has passed; maintainer review remains.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 2

• archify/package-lock.json is excluded by !**/package-lock.json
• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: tt-a1i/archify
• Branch: dev
• File: .coderabbit.yaml
• Commit: c6b74b5
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: b377a9d9-01dd-4969-9718-d030a7e24f0c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[tt-a1i]

Thanks @HengYangDS for following through on your report and sketch. Your two lockfile changes match our independently prepared #1246 byte-for-byte against the same dev base, so we will keep your contribution and close ours as the duplicate.

The scoped local install, audit, core and generated checks in #1246 are additional evidence on identical lockfile contents, at its recorded Node/npm versions; they do not replace your current-head CI. Before final review, please personally review the submitted changes and explanation and confirm the contributor checkbox (or reply with the same confirmation). No rerun of the matching local checks is requested. This is not approval or authorization to merge.

[HengYangDS]

CI is blocked by the README showcase receipt, rather than the lock update. The failed job reports classic: source artifact drift in test/readme-showcase.test.mjs:188. I reproduced the same expected ca273484… / actual 7f68d730… mismatch locally.

The test, builder, GIF, receipt and all three source artifacts are byte-identical to the PR base 63c9263e. The two-lockfile diff remains unchanged. Could the showcase owner refresh its generated artifact and receipt on dev? I will rebase this PR onto that repair and verify current-head CI.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[HengYangDS]

#1304 fixed the WebM browser startup failure. Rebased onto dev c6b74b5f at fa7e352f, this PR now passes all 19 CI jobs; two deployment jobs are skipped. Current run.

The two-lockfile patch is unchanged from the qualified version, and both manifests are unchanged. This is ready for review. Earlier README and sandbox failures remain documented above; the sandbox restoration request is resolved.