[chmaltsp]

Lockfile-only targeted update (ranges already allow the fixed versions; CI doesn't regenerate the lockfile).

Resolved: axios 1.21.0 (runtime), follow-redirects 1.16.2 (runtime), handlebars 4.7.10 (critical), markdown-it 14.3.3, js-yaml 3.15.2/4.3.2, brace-expansion, fast-copy.

Not addressed (needs a human):

• zod (GHSA-mrhx-c7xc-m3w5, high, dev): only zod 3.25.76 via @seamapi/blueprint 1.10.0. The fix needs blueprint >= 1.12.0, which is published only to npm.pkg.github.com; CI installs can't authenticate to it (first attempt of this PR failed with E401). Also a zod 3→4 override would be a major bump.
• minimatch / glob (moderate, dev): fixes are major bumps (minimatch 11, glob 14) via typedoc/typescript-eslint.
• tj-actions/changed-files alert (Add test with fake seam connect #7) in automerge.yml: workflow edits out of scope.

Verified locally: typecheck, lint, 176 tests pass.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T01:06:13.957680Z	dbcaaf1	PR opened
🔒 Security Review	✅ Completed 2026-11-07T01:06:24.303212Z	dbcaaf1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbcaaf1ab4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore registry URLs that allow unauthenticated installs

In a clean environment without GitHub Packages credentials, npm ci now fetches this package—and @seamapi/smith at line 1090—from npm.pkg.github.com, whose npm packages require authentication even when public. The repository's normal setup action runs npm ci while configuring only https://registry.npmjs.org and provides no NODE_AUTH_TOKEN (.github/actions/setup/action.yml:22-39), so CI and unauthenticated developer installs will fail before tests run; keep these dependencies resolved through the public npm registry or configure GitHub Packages authentication for every install path.

Useful? React with 👍 / 👎.

[chmaltsp]

All CI checks green except Vercel, which is also failing on main (pre-existing, unrelated). Not auto-merged: first live sweep run, no human-merge history yet.