[oskarbarcz]

Why

npm audit found 13 issues (11 moderate, 2 low), all in build and test tooling; npm audit --omit=dev was already clean. The moderate one is glob (GHSA-3g3m-2fjr-6pw4, affected 9.0.0 to 14.0.1), which Jest, Cucumber and the Nest CLI pull in.

What changes

• overrides: "glob@>=9.0.0 <14.0.2": "^14.0.4". Only the affected range moves, and every consumer now shares glob 14.0.4.
• npm audit fix moved dev tools within their ranges: jest 30.5.2, @cucumber/cucumber 12.9.0 and @nestjs/cli 11.0.24. No runtime package version changed; the lockfile was compared against main.
• Version: 3.80.4.

Left

• deepmerge (low, GHSA-gcqx-w48m-w2h4), 8 entries. 4.3.1 is the newest release and is still affected. It comes in through jest-config and the Nest CLI's type checker. Nest CLI 12 would drop one path, but jest-config keeps the other, so I didn't take that major.
• @parcel/watcher 2.6.0 arrives with jest-haste-map 30.5. Its install script is blocked by allowScripts, so npm warns on install. The prebuilt binary loads, so nothing breaks; whether to allow the script is your call.

Verification

• npm run lint, 1,078 Jest tests (109 suites) and all 1,602 functional scenarios pass on the first run. The dev server restarted healthy on the new tools.
• npm run format fails locally only on the gitignored infra/.terraform provider binaries. A CI checkout doesn't have them.
• npm audit: 13 → 8 low. --omit=dev: 0.

🤖 Generated with Claude Code

[github-actions]

OpenTofu plan for infra

Commit f262cb3 · Plan: 1 to add, 1 to change, 1 to destroy.

Show plan

 OpenTofu used the selected providers to generate the following execution
 plan. Resource actions are indicated with the following symbols:
!  ~ update in-place (current -> planned)
!-/+ destroy and then create replacement
 
 OpenTofu will perform the following actions:
 
   # aws_ecs_service.app will be updated in-place
!  ~ resource "aws_ecs_service" "app" {
         id                                 = "arn:aws:ecs:eu-central-1:805830022748:service/mypreflight/flight-tracker-api"
         name                               = "flight-tracker-api"
         tags                               = {}
!      ~ task_definition                    = "arn:aws:ecs:eu-central-1:805830022748:task-definition/flight-tracker-api:6" -> (known after apply)
         # (19 unchanged attributes hidden)
 
         # (4 unchanged blocks hidden)
     }
 
   # aws_ecs_task_definition.app must be replaced
!-/+ resource "aws_ecs_task_definition" "app" {
!      ~ arn                      = "arn:aws:ecs:eu-central-1:805830022748:task-definition/flight-tracker-api:6" -> (known after apply)
!      ~ arn_without_revision     = "arn:aws:ecs:eu-central-1:805830022748:task-definition/flight-tracker-api" -> (known after apply)
!      ~ container_definitions    = jsonencode(
!          ~ [
                 {
                     command                = [
                         "tunnel",
                         "--no-autoupdate",
                         "--metrics",
                         "localhost:20241",
                         "--grace-period",
                         "20s",
                         "run",
                     ]
                     dependsOn              = [
                         {
                             condition     = "HEALTHY"
                             containerName = "flight-tracker-api"
                         },
                     ]
                     environment            = []
                     essential              = true
                     healthCheck            = {
                         command     = [
                             "CMD",
                             "cloudflared",
                             "tunnel",
                             "--metrics",
                             "localhost:20241",
                             "ready",
                         ]
                         interval    = 5
                         retries     = 6
                         startPeriod = 10
                         timeout     = 2
                     }
                     image                  = "cloudflare/cloudflared@sha256:4955524aeaa379e154023d5a027c250f7b35041a2e7e950cf13f144bc9b9c5ba"
                     linuxParameters        = {
                         capabilities = {
                             add  = []
                             drop = [
                                 "ALL",
                             ]
                         }
                     }
                     logConfiguration       = {
                         logDriver = "awslogs"
                         options   = {
                             awslogs-group         = "/ecs/flight-tracker-api"
                             awslogs-region        = "eu-central-1"
                             awslogs-stream-prefix = "cloudflared"
                         }
                     }
                     mountPoints            = []
                     name                   = "cloudflared"
                     portMappings           = []
                     readonlyRootFilesystem = true
                     secrets                = [
                         {
                             name      = "TUNNEL_TOKEN"
                             valueFrom = "arn:aws:ssm:eu-central-1:805830022748:parameter/mypreflight/api/cloudflare-tunnel-token"
                         },
                     ]
                     systemControls         = []
                     volumesFrom            = []
                 },
!              ~ {
!                  ~ image                  = "ghcr.io/mypreflight/flight-tracker-api:3.80.3" -> "ghcr.io/mypreflight/flight-tracker-api:3.80.4"
                     name                   = "flight-tracker-api"
                     # (11 unchanged attributes hidden)
                 },
             ] # forces replacement
         )
!      ~ enable_fault_injection   = false -> (known after apply)
!      ~ id                       = "flight-tracker-api" -> (known after apply)
!      ~ revision                 = 6 -> (known after apply)
-      - tags                     = {} -> null
         # (11 unchanged attributes hidden)
 
-      - volume {
-          - configure_at_launch = false -> null
-          - name                = "tmp" -> null
         }
+      + volume {
+          + configure_at_launch = (known after apply)
+          + name                = "tmp"
         }
 
         # (1 unchanged block hidden)
     }
 
 Plan: 1 to add, 1 to change, 1 to destroy.
 
 Changes to Outputs:
!  ~ app_image        = "ghcr.io/mypreflight/flight-tracker-api:3.80.3" -> "ghcr.io/mypreflight/flight-tracker-api:3.80.4"

Workflow run