The numbers, runtime scope only
critical 5
high 26
medium 38
low 14
with a patched version available: all 83
top packages: next x34, Django x17, django x12
Mixed Node and Python, so npm audit fix --package-lock-only covers the Node half and the Django side needs its own bump. Last push 2026-08-26, so this one is live.
Context
Dependabot alerts went on across the org today (bautrey/claudecode#191) — 41 of 54 repos had them off. Per-repo numbers went to 14 live sessions over cc-bus; this repo has no session, so it gets an issue.
Two things to check before patching: whether the prod build consumes the lockfile (gateway's does not — it copies only package.json and runs npm install, so a bump never reaches the image), and whether it omits dev dependencies (if it runs npm ci --only=production, dev-scope alerts never enter the artifact at all).
Runtime scope rather than severity, because severity ranked the wrong axis: 11 criticals triaged across the org were all unreachable, while the actionable set was runtime-scope highs.
The numbers, runtime scope only
Mixed Node and Python, so
npm audit fix --package-lock-onlycovers the Node half and the Django side needs its own bump. Last push 2026-08-26, so this one is live.Context
Dependabot alerts went on across the org today (bautrey/claudecode#191) — 41 of 54 repos had them off. Per-repo numbers went to 14 live sessions over cc-bus; this repo has no session, so it gets an issue.
Two things to check before patching: whether the prod build consumes the lockfile (gateway's does not — it copies only package.json and runs
npm install, so a bump never reaches the image), and whether it omits dev dependencies (if it runsnpm ci --only=production, dev-scope alerts never enter the artifact at all).Runtime scope rather than severity, because severity ranked the wrong axis: 11 criticals triaged across the org were all unreachable, while the actionable set was runtime-scope highs.