[hoangsvit]

Release develop → main (Nov 2, 2026)

Promote the already-reviewed security remediation from #317 into production.

Scope

• Resolve Vue I18n / @intlify 11.4.14 to address XSS advisories GHSA-83rm-6c8r-g728 and GHSA-8rc2-428q-7ww3.
• Remove vulnerable nested Vue I18n 10.x extension by upgrading @intlify/vue-i18n-extensions to 9.0.0.
• Resolve follow-redirects 1.16.2 to address GHSA-mrwp-f3q8-3g9p.
• Include regenerated npm lockfile and dependency regression checks.
• Preserve current Nuxt 4.6.3, GA4 production-only tracking, radio streaming and existing main source without force pushing or rewriting history.

Verified baseline

• PR security(deps): patch Vue I18n XSS and follow-redirects advisories #317 exact-head CI #41378621388 succeeded (unit tests, high/critical npm audit, full prerender/SEO/GA4).
• develop staging deployment #41379185031 succeeded.

Release gates

• Exact-head release CI passes against main.
• No merge conflicts or unexpected changes beyond scoped security patch.
• Merge using merge commit; no force push.
• Verify main production deployment success after merge.

Known follow-up

• deepmerge GHSA-gcqx-w48m-w2h4 is tracked under #315, with no known fixed upstream version.
• GitHub Code Scanning alerts require separate confirmation; npm audit passing does not close CodeQL findings.
• The existing Dependabot PR build(deps): bump the npm-version-nonbreaking group with 3 updates #316 has a failed audit and must not be merged as-is.

Keep security audit required; no bypass or blanket alert dismissal.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: ePlus-DEV/radio.eplus.dev
• Branch: develop
• File: .coderabbit.yaml
• Commit: f37c22c
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: f333fc52-b672-4be6-bb0b-bcf9cc9140d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn