You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I removed c8 and its related coverage configurations since we're not really using it anymore. This naturally resolves the security alerts caused by the older cross-spawn version that c8 was pulling in, while also cleaning up some technical debt.
I've also kept the cross-spawn resolution just to be safe in case any other transitive deps are still hitting it, but the primary fix was stripping out the unused dependency as suggested.
RinZ27
changed the title
[Security] Force cross-spawn to v7.0.6 via resolutions
fix(deps): resolve cross-spawn to v7.0.6 to fix vulnerabilities
Jan 17, 2026
RinZ27
changed the title
fix(deps): resolve cross-spawn to v7.0.6 to fix vulnerabilities
deps: resolve cross-spawn to v7.0.6 to fix vulnerabilities
Jan 17, 2026
@connorjclark Agreed. If we're not using c8 anymore, dropping it is a much better long-term fix than patching the transitive dep. I'll check the build/test configs and strip it out.
RinZ27
changed the title
deps: resolve cross-spawn to v7.0.6 to fix vulnerabilities
chore: remove unused c8 and update cross-spawn resolution
Jan 20, 2026
@connorjclark Done. I've stripped out c8 and cleaned up the related coverage configurations as we discussed, which I believe is a much cleaner approach. This also naturally resolves the cross-spawn vulnerability. I noticed the Vercel preview build is failing, but after checking my changes, I suspect it might be an environment issue or unrelated to the dependency removal—could you or someone else on the team take a look when you have a moment?
RinZ27
changed the title
chore: remove unused c8 and update cross-spawn resolution
deps: remove unused c8 and update cross-spawn resolution
Jan 20, 2026
The reason will be displayed to describe this comment to others. Learn more.
Reviewed the changes.
Removing the unused c8 dependency makes sense and effectively addresses the cross-spawn vulnerability while reducing technical debt. Keeping the resolution as a safety net also looks reasonable.
Thanks for removing this. I don't think we ever made use of coverage data, and sort of cargo-culted our way to this extra complexity. I'm glad to be rid of it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I removed
c8and its related coverage configurations since we're not really using it anymore. This naturally resolves the security alerts caused by the oldercross-spawnversion thatc8was pulling in, while also cleaning up some technical debt.I've also kept the
cross-spawnresolution just to be safe in case any other transitive deps are still hitting it, but the primary fix was stripping out the unused dependency as suggested.