[Mateusz7410]

Summary

• vite override 6.4.3 -> 6.4.5 (5 Dependabot alerts, one high)
• New override "minimatch@>=7": "11.0.5" (Dependabot medium). The 3.x copies used by eslint are outside the advisory range and stay.
• zod 4.1.11 -> 4.6.7 through @vercel/functions 3.11.0 (high, from npm audit)
• joi 18.2.9 -> 18.3.2 through prettier-plugin-apex (high, from npm audit)

Why

Open Dependabot and npm audit advisories. All of it is dev tooling and the docs site (middleware.js uses @vercel/functions). Nothing here ships in the Salesforce package or a source deploy.

deepmerge (low, via jest-config) stays open: there is no patched version, and npm's only suggestion is a downgrade of sfdx-lwc-jest to 0.8.0. It only merges our local Jest config.

The lockfile was updated with targeted npm update calls, not npm audit fix, which also pulled sfdx-lwc-jest 7.9.0 and a new LWC compiler.

Test plan

• bash dev/verify/verify.sh all passed (Jest 213/213, mock 66/66, full 441/441 at 97%, ns 31/31)
• npm run docs:build passed
• middleware.js imports with the new @vercel/functions
• npm audit: only deepmerge left

Files

• package.json
• package-lock.json

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
async-lib	Ready	Preview	Nov 7, 2026 7:07pm UTC

[github-actions]

🚀 Salesforce CI

⏭️ Deployment skipped

An earlier step failed (scratch org creation or Dev Hub authorization), so nothing was deployed. Check the workflow logs.

📦 Workflow run, logs and artifacts

---

🤖 Automated comment by Salesforce CI