[hoangsvit]

Security advisories fixed in this PR

• GHSA-83rm-6c8r-g728 / GHSA-8rc2-428q-7ww3: remove vulnerable Vue I18n 11.4.13 and nested EOL v10; resolve Vue I18n and matching @intlify packages to 11.4.14 and upgrade @intlify/vue-i18n-extensions to 9.0.0.
• GHSA-mrwp-f3q8-3g9p: resolve follow-redirects to 1.16.2.
• Reproducible package-lock refreshed using npm registry with lifecycle scripts disabled. The branch-scoped temporary refresh workflow was removed afterward.
• Added tests that reject re-introduction of vulnerable versions in any nested resolved dependency.

Verification

• Lockfile regenerated and the temporary write-permission workflow removed; final PR contains only manifest, lockfile and tests.
• PR CI #41378621388 installed via npm ci.
• Unit tests passed on that CI run.
• Production npm audit --omit=dev --audit-level=high passed on that CI run.
• Full Nuxt prerender, SEO and GA4 output checks complete on exact PR head (green CI #41378621388, SHA b4a41d2dd8b70e25a7f7b4b93952a7e675219840).
• Merge to develop after final CI success and review; promote to main separately.

Remaining risk

GHSA-gcqx-w48m-w2h4 (deepmerge 4.3.1 prototype poisoning) has no upstream patched version as of 2026-11-02. Tracked in #315; do not downgrade Nuxt via npm audit fix --force or dismiss the advisory.
The moderate glob/minimatch advisories also remain for future compatibility-reviewed dependency upgrades.
GitHub's private Security alert list is not accessible through the current connector, so reconcile exact alert IDs in the dashboard before claiming all alerts cleared.

Do not bypass CI, auto-merge, or deploy directly to main.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: ePlus-DEV/radio.eplus.dev
• Branch: security/remediate-i18n-redirects-20261102
• File: .coderabbit.yaml
• Commit: b4a41d2
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: be5e8f5a-f059-43e8-8deb-102260dd1f58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing