Skip to content

fix: update Claude Code js-yaml override - #3844

Closed
Jeff Stock (jstock03) wants to merge 3 commits into
microsoft:mainfrom
jstock03:fix/claude-js-yaml-advisories
Closed

fix: update Claude Code js-yaml override#3844
Jeff Stock (jstock03) wants to merge 3 commits into
microsoft:mainfrom
jstock03:fix/claude-js-yaml-advisories

Conversation

@jstock03

@jstock03 Jeff Stock (jstock03) commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Why

S360 and Component Governance flag the Claude Code package's overridden js-yaml 4.2.0 for two related advisories. Both alerts apply to the same installed package instance, so one override and lockfile update is the smallest complete remediation.

Vulnerabilities

Change

Update only the Claude Code package's transitive js-yaml override and lockfile from 4.2.0 to 4.3.1.

Validation

  • npm ci reports zero vulnerabilities
  • npm ls js-yaml resolves js-yaml 4.3.1 overridden
  • npm run check passes 17 tests
  • npm test passes 17 tests

@jstock03
fix: update Claude Code js-yaml override
b4210a9 
Signed-off-by: Jeff Stock <jstock@microsoft.com>
@azure-pipelines

azure-pipelines Bot commented Aug 27, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@github-actions github-actions Bot added the size/S Small PR (< 50 lines) label Aug 27, 2026
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

PR Review Summary

Check Status Details
🔍 Code Review ⚠️ Missing No current-run comment
🛡️ Security Scan ⚠️ Missing No current-run comment
🔄 Breaking Changes ⚠️ Missing No current-run comment
📝 Docs Sync ⚠️ Missing No current-run comment
🧪 Test Coverage ⚠️ Missing No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

@jstock03
docs: audit Claude Code js-yaml update
b60c437 
Signed-off-by: Jeff Stock <jstock@microsoft.com>
@github-actions github-actions Bot added documentation Improvements or additions to documentation size/M Medium PR (< 200 lines) and removed size/S Small PR (< 50 lines) labels Aug 27, 2026
@jstock03
docs: allow advisory ID in Claude audit
9bfaf09 
Signed-off-by: Jeff Stock <jstock@microsoft.com>
Closed
imran-siddique
Imran Siddique (imran-siddique) reviewed Sep 3, 2026
View reviewed changes

@imran-siddique Imran Siddique (imran-siddique) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same review as #3843, since this is the Claude Code half of the same three-package bump. The short
version, so you do not have to cross-reference:

The bump is correct. GHSA-52cp-r559-cp3m (CVE-2026-59869, high) is patched in 4.3.0 and
GHSA-5p4m-2wfm-xmqj (high) in 4.3.1, so 4.2.0 is exposed to both and 4.3.1 clears both. I checked
that 4.3.1 is not itself carrying an open advisory: the only newer high against js-yaml is
GHSA-pm4m-ph32-ghv5 (CVE-2026-73643), scoped to >=5.0.0 <=5.2.1, which does not reach the 4.x line.

Worth fixing before merge: the lockfile entry has
"resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/js-yaml/-/js-yaml-4.3.1.tgz"
and "integrity": "sha1-ASFsAB1n9I4s1WDXCMevIQkKOEg=". The public registry serves
https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz with
sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==.

The tarball you got is genuine, so this is not a tampering concern: the SHA-1 decodes to
01216c001d67f48e2cd560d708c7af21090a3848, which is npm's published shasum for that exact
version. The issue is that the recorded integrity is SHA-1 rather than SHA-512, which is a weaker
pin than every other entry in every lockfile in this repository, and the resolved URL points at an
internal mirror an external fork's CI cannot rely on. Across all 12 lockfiles on main there are
currently zero of each, so these three PRs would introduce the first.

Regenerating against the public registry fixes both in one step. The full reasoning, including the
overrides block that drops out of packages[""], is on #3843.

Everything else is good, and the audit doc is the right format.

Closed
3 tasks done
Imran Siddique (imran-siddique) pushed a commit that referenced this pull request Sep 3, 2026
@imransiddique-ai @claude
docs(deps): correct the js-yaml audit, and restore the lockfile overr…
f7f56a8 
…ides

The audit read the SDK's declared js-yaml and concluded the bump exchanged
two HIGH advisories for one. It does not. All three packages declare
overrides.js-yaml 4.2.0 in package.json, so every lockfile resolves
node_modules/js-yaml to 4.2.0 both before and after the SDK bump.
npm ci followed by npm ls js-yaml reports "js-yaml@4.2.0 overridden", and
npm audit against this tree reports GHSA-5p4m-2wfm-xmqj and
GHSA-52cp-r559-cp3m, the two 4.x HIGH advisories the document claimed were
being left behind. GHSA-pm4m-ph32-ghv5 cannot apply, because 5.2.1 is never
installed.

Also restores the root "overrides" block in the three lockfiles. package.json
declares it and main's lockfiles record it; the regenerated lockfiles here
dropped it while keeping the 4.2.0 resolution, so the lock no longer recorded
the reason for its own pin. npm ci succeeds either way, which is why nothing
caught it.

Names the conflict with #3843, #3844 and #3875, which move the override to
4.3.1 in the same files and do clear both advisories.

Reported by @prayagupa in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BiraRPG9NcLDZsNSmSXxE7
Merged
Imran Siddique (imran-siddique) added a commit that referenced this pull request Sep 3, 2026
@imran-siddique @claude
docs(deps): correct the js-yaml audit, and restore the lockfile overr…
dc83a6e 
…ides

The audit read the SDK's declared js-yaml and concluded the bump exchanged
two HIGH advisories for one. It does not. All three packages declare
overrides.js-yaml 4.2.0 in package.json, so every lockfile resolves
node_modules/js-yaml to 4.2.0 both before and after the SDK bump.
npm ci followed by npm ls js-yaml reports "js-yaml@4.2.0 overridden", and
npm audit against this tree reports GHSA-5p4m-2wfm-xmqj and
GHSA-52cp-r559-cp3m, the two 4.x HIGH advisories the document claimed were
being left behind. GHSA-pm4m-ph32-ghv5 cannot apply, because 5.2.1 is never
installed.

Also restores the root "overrides" block in the three lockfiles. package.json
declares it and main's lockfiles record it; the regenerated lockfiles here
dropped it while keeping the 4.2.0 resolution, so the lock no longer recorded
the reason for its own pin. npm ci succeeds either way, which is why nothing
caught it.

Names the conflict with #3843, #3844 and #3875, which move the override to
4.3.1 in the same files and do clear both advisories.

Reported by @prayagupa in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BiraRPG9NcLDZsNSmSXxE7
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
MohammadHaroonAbuomar
MohammadHaroonAbuomar requested changes Sep 10, 2026
View reviewed changes

@MohammadHaroonAbuomar MohammadHaroonAbuomar left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • package-lock.json — the js-yaml 'resolved' URL points at ms-feed-2.pkgs.visualstudio.com (an internal feed); no lockfile on main uses that host, and an external 'npm ci' would fail to fetch it. Please regenerate against registry.npmjs.org.
  • 4.3.1 is still vulnerable: GHSA-2883-xcg3-v3hh (high, published 2026-09-08) is fixed in js-yaml 4.3.2, which is also the v4-legacy dist-tag and past the 7-day cooling window. #3894 already raises all four CLI packages to 4.3.2 with npmjs.org URLs — consider closing this in favor of #3894 rather than iterating.

Imran Siddique (imran-siddique) added a commit that referenced this pull request Sep 14, 2026
@imran-siddique @claude
docs(deps): a third js-yaml HIGH applies to 4.2.0, and only 4.3.2 cle…
8e93e4b 
…ars it

The js-yaml section said `npm audit` reports "both, and no others". A third HIGH
was published on 2026-09-08 and is also in range for the 4.2.0 the override
holds: GHSA-2883-xcg3-v3hh, maxTotalMergeKeys failing to limit CPU use for empty
merge sources, affecting >= 4.0.0 < 4.3.2, first patched in 4.3.2.

It postdates the npm audit output the document quotes, which is now said
explicitly rather than leaving the quoted output looking incomplete.

It also changes which fix is sufficient, so that is recorded: #3843, #3844 and
#3875 each raise the override to 4.3.1, which clears the first two advisories
and leaves this one in range. Only #3894, at 4.3.2, clears all three.

Verified against the advisory API, with a control advisory resolved through the
same lookup, and the four PRs' own diffs read for the version each moves to.

Raised by @MohammadHaroonAbuomar in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
MohammadHaroonAbuomar pushed a commit that referenced this pull request Sep 15, 2026
@imran-siddique @dependabot @claude
chore(deps): bump agent-governance-sdk to 5.0.0 in the three CLI pack…
d37d381 
…ages, with audit (#3721)

* chore(deps): Bump @microsoft/agent-governance-sdk

Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases)
- [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript)

---
updated-dependencies:
- dependency-name: "@microsoft/agent-governance-sdk"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): Bump @microsoft/agent-governance-sdk

Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases)
- [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript)

---
updated-dependencies:
- dependency-name: "@microsoft/agent-governance-sdk"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): Bump @microsoft/agent-governance-sdk

Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases)
- [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript)

---
updated-dependencies:
- dependency-name: "@microsoft/agent-governance-sdk"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* docs(deps): audit the sdk 5.0.0 bump in the three CLI packages

The vendored-patch-audit gate greps the PR's own diff for the audit doc,
and exempts dependabot only for non-major updates, so a semver-major
bump opened by dependabot can never satisfy it on its own branch.

Carries the three dependabot commits unchanged and adds the audit
alongside them. Records that the bump does not clear these packages of a
js-yaml advisory: it moves off two HIGH advisories in 4.1.1 onto one in
5.2.1, which is first patched in 5.2.2.

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* ci(cspell): ignore GHSA and CVE identifiers, add the omap YAML tag

The audit doc above failed spell-check on fragments of GHSA identifiers
(xmqj, mxrg, fgmg). Advisory IDs are random strings, so adding each one
to the dictionary would grow it by three entries per advisory cited and
would recur on every future security audit doc.

Matching the identifier shape instead fixes the class. Also adds omap,
the YAML ordered-map tag, which is a real term rather than a random one.

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): note that the SDK js-yaml repin already landed on main

#3623 moved the SDK source to js-yaml 5.2.3 earlier today, so the
recommendation to repin was already stale when written. The residual
exposure is in the published 5.0.0 artifact, which pins 5.2.1 and is
immutable, so it closes on the next SDK publish rather than by any change
to these lockfiles.

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): correct the js-yaml audit, and restore the lockfile overrides

The audit read the SDK's declared js-yaml and concluded the bump exchanged
two HIGH advisories for one. It does not. All three packages declare
overrides.js-yaml 4.2.0 in package.json, so every lockfile resolves
node_modules/js-yaml to 4.2.0 both before and after the SDK bump.
npm ci followed by npm ls js-yaml reports "js-yaml@4.2.0 overridden", and
npm audit against this tree reports GHSA-5p4m-2wfm-xmqj and
GHSA-52cp-r559-cp3m, the two 4.x HIGH advisories the document claimed were
being left behind. GHSA-pm4m-ph32-ghv5 cannot apply, because 5.2.1 is never
installed.

Also restores the root "overrides" block in the three lockfiles. package.json
declares it and main's lockfiles record it; the regenerated lockfiles here
dropped it while keeping the 4.2.0 resolution, so the lock no longer recorded
the reason for its own pin. npm ci succeeds either way, which is why nothing
caught it.

Names the conflict with #3843, #3844 and #3875, which move the override to
4.3.1 in the same files and do clear both advisories.

Reported by @prayagupa in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BiraRPG9NcLDZsNSmSXxE7
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): a third js-yaml HIGH applies to 4.2.0, and only 4.3.2 clears it

The js-yaml section said `npm audit` reports "both, and no others". A third HIGH
was published on 2026-09-08 and is also in range for the 4.2.0 the override
holds: GHSA-2883-xcg3-v3hh, maxTotalMergeKeys failing to limit CPU use for empty
merge sources, affecting >= 4.0.0 < 4.3.2, first patched in 4.3.2.

It postdates the npm audit output the document quotes, which is now said
explicitly rather than leaving the quoted output looking incomplete.

It also changes which fix is sufficient, so that is recorded: #3843, #3844 and
#3875 each raise the override to 4.3.1, which clears the first two advisories
and leaves this one in range. Only #3894, at 4.3.2, clears all three.

Verified against the advisory API, with a control advisory resolved through the
same lookup, and the four PRs' own diffs read for the version each moves to.

Raised by @MohammadHaroonAbuomar in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): reconcile remaining js-yaml audit claims

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): correct SDK source js-yaml pin history

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@MohammadHaroonAbuomar

MohammadHaroonAbuomar commented Sep 26, 2026

Copy link
Copy Markdown
Collaborator

Closing as stale: changes were requested on 2026-09-10 and there has been no response from the author for 16 days. The review notes above still apply; reopen this PR or open a fresh one when you can pick it up again.

Yuvraj Singh (yuvrajsingh2428) pushed a commit to yuvrajsingh2428/agent-governance-toolkit that referenced this pull request Oct 1, 2026
@imran-siddique @dependabot
@claude @yuvrajsingh2428
chore(deps): bump agent-governance-sdk to 5.0.0 in the three CLI pack…
e005693 
…ages, with audit (microsoft#3721)

* chore(deps): Bump @microsoft/agent-governance-sdk

Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases)
- [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript)

---
updated-dependencies:
- dependency-name: "@microsoft/agent-governance-sdk"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): Bump @microsoft/agent-governance-sdk

Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases)
- [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript)

---
updated-dependencies:
- dependency-name: "@microsoft/agent-governance-sdk"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): Bump @microsoft/agent-governance-sdk

Bumps [@microsoft/agent-governance-sdk](https://github.com/microsoft/agent-governance-toolkit/tree/HEAD/agent-governance-typescript) from 4.0.0 to 5.0.0.
- [Release notes](https://github.com/microsoft/agent-governance-toolkit/releases)
- [Changelog](https://github.com/microsoft/agent-governance-toolkit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/microsoft/agent-governance-toolkit/commits/v5.0.0/agent-governance-typescript)

---
updated-dependencies:
- dependency-name: "@microsoft/agent-governance-sdk"
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* docs(deps): audit the sdk 5.0.0 bump in the three CLI packages

The vendored-patch-audit gate greps the PR's own diff for the audit doc,
and exempts dependabot only for non-major updates, so a semver-major
bump opened by dependabot can never satisfy it on its own branch.

Carries the three dependabot commits unchanged and adds the audit
alongside them. Records that the bump does not clear these packages of a
js-yaml advisory: it moves off two HIGH advisories in 4.1.1 onto one in
5.2.1, which is first patched in 5.2.2.

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* ci(cspell): ignore GHSA and CVE identifiers, add the omap YAML tag

The audit doc above failed spell-check on fragments of GHSA identifiers
(xmqj, mxrg, fgmg). Advisory IDs are random strings, so adding each one
to the dictionary would grow it by three entries per advisory cited and
would recur on every future security audit doc.

Matching the identifier shape instead fixes the class. Also adds omap,
the YAML ordered-map tag, which is a real term rather than a random one.

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): note that the SDK js-yaml repin already landed on main

microsoft#3623 moved the SDK source to js-yaml 5.2.3 earlier today, so the
recommendation to repin was already stale when written. The residual
exposure is in the published 5.0.0 artifact, which pins 5.2.1 and is
immutable, so it closes on the next SDK publish rather than by any change
to these lockfiles.

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): correct the js-yaml audit, and restore the lockfile overrides

The audit read the SDK's declared js-yaml and concluded the bump exchanged
two HIGH advisories for one. It does not. All three packages declare
overrides.js-yaml 4.2.0 in package.json, so every lockfile resolves
node_modules/js-yaml to 4.2.0 both before and after the SDK bump.
npm ci followed by npm ls js-yaml reports "js-yaml@4.2.0 overridden", and
npm audit against this tree reports GHSA-5p4m-2wfm-xmqj and
GHSA-52cp-r559-cp3m, the two 4.x HIGH advisories the document claimed were
being left behind. GHSA-pm4m-ph32-ghv5 cannot apply, because 5.2.1 is never
installed.

Also restores the root "overrides" block in the three lockfiles. package.json
declares it and main's lockfiles record it; the regenerated lockfiles here
dropped it while keeping the 4.2.0 resolution, so the lock no longer recorded
the reason for its own pin. npm ci succeeds either way, which is why nothing
caught it.

Names the conflict with microsoft#3843, microsoft#3844 and microsoft#3875, which move the override to
4.3.1 in the same files and do clear both advisories.

Reported by @prayagupa in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BiraRPG9NcLDZsNSmSXxE7
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): a third js-yaml HIGH applies to 4.2.0, and only 4.3.2 clears it

The js-yaml section said `npm audit` reports "both, and no others". A third HIGH
was published on 2026-09-08 and is also in range for the 4.2.0 the override
holds: GHSA-2883-xcg3-v3hh, maxTotalMergeKeys failing to limit CPU use for empty
merge sources, affecting >= 4.0.0 < 4.3.2, first patched in 4.3.2.

It postdates the npm audit output the document quotes, which is now said
explicitly rather than leaving the quoted output looking incomplete.

It also changes which fix is sufficient, so that is recorded: microsoft#3843, microsoft#3844 and
microsoft#3875 each raise the override to 4.3.1, which clears the first two advisories
and leaves this one in range. Only microsoft#3894, at 4.3.2, clears all three.

Verified against the advisory API, with a control advisory resolved through the
same lookup, and the four PRs' own diffs read for the version each moves to.

Raised by @MohammadHaroonAbuomar in review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): reconcile remaining js-yaml audit claims

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

* docs(deps): correct SDK source js-yaml pin history

Signed-off-by: Imran Siddique <imran.siddique@opaque.co>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: yuvrajsingh2428 <offcyuvi2428@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@imran-siddique Imran Siddique (imran-siddique) imran-siddique left review comments
@MohammadHaroonAbuomar MohammadHaroonAbuomar MohammadHaroonAbuomar requested changes
@liamcrumm liamcrumm Awaiting requested review from liamcrumm liamcrumm is a code owner

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation size/M Medium PR (< 200 lines)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jstock03 @MohammadHaroonAbuomar @imran-siddique