[valuecodes]

What

• Refs Maintenance dashboard #25
• Fixes 8 of 12 audit findings: hono GHSA-5r4p-p66f-jhc7; vite GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg, GHSA-9jrq-w75r-8gcw; source-map-js GHSA-68fv-2mgg-jv7q.
• Bumps: hono 4.13.9 → 4.13.13, openai 7.23.0 → 7.32.0, drizzle-orm 0.45.3 → 0.45.4, oxlint-tsgolint 7.0.2003 → 7.0.2004, @cloudflare/workers-types 5.20261010.1 → 5.20261011.1, pnpm 12.11.2 → 12.12.0.
• New exact override vite: 8.3.4 (vitest 5.0.3 has no patched release past the 14-day age yet); it also pulls postcss 8.5.29 → source-map-js 1.2.2.
• Still open, waiting on minimumReleaseAge: zod GHSA-mrhx-c7xc-m3w5 (4.6.6, eligible 2026-10-25) and undici GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472 (7.30.1, eligible 2026-10-29; dev tooling only).

Vetting

Package	Change	Age	Provenance	Publisher	Scripts	Diff	Verdict
hono	4.13.9 → 4.13.13	21d	same	same	none	large (build moved to rolldown, all dist re-emitted; no risky patterns)	review, kept
openai	7.23.0 → 7.32.0	16d	same	same	none	clean	ok
drizzle-orm	0.45.3 → 0.45.4	17d	same	same	none	clean	ok
oxlint-tsgolint	7.0.2003 → 7.0.2004	15d	same	same	none	clean	ok
@cloudflare/workers-types	5.20261010.1 → 5.20261011.1	14d	same	same	none	clean	ok
pnpm	12.11.2 → 12.12.0	15d	same	same	unchanged	clean	ok
vite	8.3.1 → 8.3.4	17d	same	same	none	clean	ok
postcss	8.5.28 → 8.5.29	20d	same	same	none	clean	ok
source-map-js	1.2.1 → 1.2.2	25d	none (as before)	same	none	eval probe added with the fix	ok
rolldown (+ bindings)	1.2.11 → 1.2.13	18d	same	same	none	clean	ok

Lockfile: no new package names, only version changes of the rows above plus their platform binaries (@pnpm/exe.*, @oxlint-tsgolint/*, @rolldown/binding-*, all with provenance). @oxc-project/types 0.151.0 dropped (0.153.0 already present).

How to test

pnpm install --frozen-lockfile
pnpm audit
pnpm typecheck
pnpm lint
pnpm knip
pnpm format:check
pnpm test

Security review

Supply-chain vetted: same provenance, publishers and install scripts; no new packages; audit drops 12 → 4 (remaining are age-held).

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T07:10:20.752793Z	13f9b8a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.