[DysektAI]

Advisory chain

Pins the discord.js → undici transitive to exactly 6.29.1 (was 6.28.1 via the ^6.28.0 override), fixing:

• GHSA-xjj6-f33q-929c (high) — unhandled error on excessive content-encodings
• GHSA-4qv8-2p9j-2685 (moderate) — unbounded memory in the EventSource parser

Vetting

• 6.29.1 published 2026-10-15 (past the 7-day cooldown), same GitHub Actions trusted publisher with SLSA provenance as 6.28.1, no lifecycle-script changes.
• Lockfile diff is only the undici entry.

Verification

• npm ci --ignore-scripts && npm test: 11/11 pass.
• npm audit --omit=dev no longer reports undici/discord.js/@discordjs/rest. Remaining standalone advisories (body-parser, follow-redirects, ip-address) are fixed in sibling PRs and combined in fix(web): share report limits and surface submission errors #38, whose audit:prod CI gate is the regression check.

Integration

Merged into #38 alongside #39/#40 so #38's merge commit lands every advisory fix together.

https://claude.ai/code/session_01NrbT7UzDQzESHKsvnJAgps

---

Summary by cubic

Pins the undici transitive dependency (via discord.js) to exactly 6.29.1, fixing GHSA-xjj6-f33q-929c (unhandled error on excessive content-encodings) and GHSA-4qv8-2p9j-2685 (unbounded memory in the EventSource parser).

Verification

• npm ci --ignore-scripts && npm test passes 11/11.
• npm audit --omit=dev no longer reports undici, discord.js, or @discordjs/rest.

^{Written for commit a5bc9f5. Summary will update on new commits.}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 80efb097-8004-412f-b474-30e2371d8f04

Commits

Reviewing files that changed from the base of the PR and between 23ca4c9 and a5bc9f5.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Summary

Summary by CodeRabbit

• Chores
  • Applied a small maintenance update. No user-facing behavior or features changed.

The undici package override now pins the dependency to version 6.29.1 instead of allowing versions that match ^6.28.0.

Changes: Dependency override

Layer / File(s)	Summary
Pin undici override package.json	The undici override changes from ^6.28.0 to the exact version 6.29.1.

Priority: Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• tarkovtracker-org/TrackerBot#38: Adds the audit:prod gate and addresses production dependency advisories, including the undici advisory covered by this version pin.

Suggested reviewers: nivmizz7

Merge Risk: Minimal · up to a5bc9

No merge-blocking issue was found in this dependency-only change.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency change and the two patched areas: content encoding and EventSource.
Description check		The description directly explains the exact undici pin, addressed advisories, verification results, and integration context.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}