[imbenrabi]

Requested by Ben · project thread

Stack and merge order

Base: #35 (claude/project-thread-1w8fky, SDK v2 + Zod 4). This PR is T1 and targets that branch. Merge order: #35 first, then this PR (GitHub retargets it to main when #35 merges), independent of T2 and T3 (disjoint files). The 0.9.0 release PR comes after all of them. Nothing is tagged or published.

What changed

• vite-plugin-dts ^4.5.4 → ^5.1.2 (dev dependency). This removes the sprintf-js / minimatch advisories that came through vite-plugin-dts 4 (@microsoft/api-extractor, @vue/language-core).
• overrides: @microsoft/api-extractor → minimatch ^11.0.1. api-extractor 7.60.1 is the latest release and still pins minimatch 10.2.3 (GHSA-g3hv-75wg-m249, moderate, no upstream fix yet), so only that dev-only dependency is moved. Drop the override once api-extractor ships a fixed minimatch.

Verification (Node 26.13.0)

• npm audit: 0 vulnerabilities (was 4 moderate on feat!: move to MCP SDK v2 and Zod 4 (base) #35). npm audit --audit-level=critical passes.
• Build output is unchanged: diff -r dist <dist built on #35> is empty, so the published declarations and bundle are identical.
• npm run typecheck ✔, npm run test:run ✔ (412 tests at branch point; 411 after feat!: move to MCP SDK v2 and Zod 4 (base) #35's review fixes, run on the merged branch).

---

Generated by Claude Code

[imbenrabi]

TS review: pipeline-ts-reviewer (feature-pipeline)

Verdict: APPROVE (round 1). No CRITICAL/HIGH findings. The reviewer confirmed the override is scoped to @microsoft/api-extractor only, the lockfile has a single minimatch 11.0.4 consumed only by api-extractor, engines are compatible (minimatch 11 20 || >=22, repo >=25.3.0), it ships nowhere (overrides are ignored in published packages), npm audit reports 0, and nothing in the diff goes beyond the stated intent.

#	Sev	Location	Finding	Resolution
1	LOW	CHANGELOG.md [Unreleased] > Fixed	The line "Only the dev-only minimatch chain through vite-plugin-dts 4 remains…" is stale once this PR removes that chain.	Fixed in 51f8949: it now says vite-plugin-dts 5 and a dev-only minimatch override clear the last dev-only audit findings.
2	LOW	package.json overrides	The override targets api-extractor, which is only an optional peer kept in the lockfile (the build does not run it, so the empty dist diff does not exercise it). Record the exit condition.	Recorded here, since package.json has no comments: the override can be dropped once @microsoft/api-extractor releases past 7.60.1 with minimatch >=10.2.4, or once the optional peer leaves the tree. If a fresh install stops installing that peer, the override just becomes inert.

{
  "recommendation": "APPROVE",
  "summary": "Minimal, correctly scoped dev-only dependency bump and nested minimatch override; engines are compatible, the lockfile has a single minimatch 11.0.4 consumed only by api-extractor, and nothing beyond stated intent is touched.",
  "findings": [
    { "severity": "LOW", "file": "CHANGELOG.md", "line": 21, "issue": "The [Unreleased] Fixed entry still says the dev-only minimatch chain through vite-plugin-dts 4 remains." },
    { "severity": "LOW", "file": "package.json", "line": 83, "issue": "Note the exit condition for removing the api-extractor minimatch override." }
  ]
}

---

Generated by Claude Code