[jphan32]

Summary

Follow-ups found after merging the Dependabot PRs #43–#45. Both Dependabot security updates (moment, minimatch) had failed because upstream version ranges block the patched releases.

1. moment alert #35 (GHSA-4p3w-j4w9-5jqw) — closed

• obsidian pins moment to exactly 2.29.4. Added the npm override moment: ^2.31.0.
• moment is used only for the type declarations in obsidian.d.ts and is never bundled. The production main.js / styles.css are byte-identical before and after.

2. minimatch alert #37 (GHSA-g3hv-75wg-m249) — vulnerable code replaced; alert will stay open

The only patched release is 11.0.1, and no upstream release (not even eslint 10) accepts 11.

• Overridden to ^11.0.1 under eslint, @eslint/config-array, @eslint/eslintrc, @typescript-eslint/typescript-estree and eslint-plugin-n.
  • These packages use only the named Minimatch / minimatch exports, which 11 keeps.
  • This replaces 9.0.9 and 10.2.5, the copies that actually contain the vulnerable code. ESLint's own file/config matching now runs on 11.0.3.
• Left alone on purpose: eslint-plugin-import / eslint-plugin-react (3.x) and eslint-plugin-json-schema-validator (8.x, pinned by eslint-plugin-obsidianmd).
  • These call the module itself or its default export, and minimatch ≥ 10 exports a plain object, so forcing 11 would crash them.
  • 3.x predates the vulnerable globParts preprocessing.
  • The json-schema-validator rules are not enabled for src/.
  • Because these copies remain in the lockfile, GitHub will keep alert fix: draw the inert footnote underline with a border, not text-decoration (1.2.2) #37 open after merge.
• Tried and dropped: a callable shim delivered through a file: override. npm 11 resolves file: overrides relative to each consumer (broken links). An npm alias to a workspace goes to the registry instead.
• Rationale and removal criteria are documented in docs/DEVELOPMENT.md.

3. package.json version drift

• The docs said to keep package.json in sync with manifest.json, but nothing checked it, and it stayed at 1.1.5 through 1.2.0–1.2.2.
• Bumped package.json / package-lock.json to 1.2.2.
• scripts/validate.mjs now fails CI on a mismatch. Confirmed it fails on the old state.
• Added the step to CONTRIBUTING.md, DEVELOPMENT.md, CLAUDE.md and the release PR checklist.

4. Stale docs

• Corrected the src/main.ts line count in CLAUDE.md (~900 → ~1,850).
• Fixed the dependabot.yml comment that still said "plain CommonJS with no build step".

No user-visible change and no release needed.

Test plan

• Full CI gate: npm ci && npm run lint && npm run build && node --check main.js && node scripts/validate.mjs
• npm ls moment → 2.31.0 everywhere. npm audit no longer reports moment. The remaining minimatch findings are only the 3.1.5 / 8.0.7 copies above.
• Differential test, minimatch 3.1.5 vs 11.0.3, on the option sets ESLint and eslint-plugin-n pass: 3,300 cases. The only differences are patterns containing .., which our config does not use.
• eslint --print-config src/main.ts is identical before and after, and the same files are linted.
• main.js / styles.css hashes unchanged.
• New transitive deps (brace-expansion 5.0.12 etc.) support Node 20 (CI).

🤖 Generated with Claude Code