Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement.

To sign the CLA, please add a comment to this PR with the following text:

I have read the CLA Document and I hereby sign the CLA

You only need to sign once. After signing, this check will pass automatically.

Greptile Summary

Adds overrides in package.json to pin 8 transitive dependencies to patched versions, resolving 11 security vulnerabilities (DoS, ReDoS, prototype pollution, XSS, data leak). The lockfile is regenerated accordingly.

• Most overrides are safe patch/minor bumps within their declared semver ranges (qs, markdown-it, lodash-es, axios, @isaacs/brace-expansion).
• @modelcontextprotocol/sdk (1.25.3 → 1.26.0) and hono (4.11.4 → 4.11.9) are direct dependencies that are upgraded within their caret ranges—low risk but should be tested.
• diff (7.0.0 → 8.0.3) is a major version override that exceeds the ^7.0.0 range declared by @google/gemini-cli-core. This is the highest-risk change and should be validated to ensure no runtime breakage in gemini CLI core functionality.

Confidence Score: 3/5

• Mostly safe security maintenance PR, but one override forces a major version bump that could break a transitive consumer.
• 7 of the 8 overrides are safe patch/minor bumps within compatible semver ranges. However, the diff override forces version 8.0.3 on a dependency (@google/gemini-cli-core) that declares ^7.0.0, crossing a major version boundary. This is the main risk. No source code changes are involved, reducing the surface area, but runtime breakage in gemini CLI core is possible if diff@8 introduced breaking changes.
• Pay close attention to package.json — specifically the diff override crossing a major version boundary for @google/gemini-cli-core.

Important Files Changed

Flowchart

flowchart TD
    A["package.json overrides"] --> B["Transitive-only overrides"]
    A --> C["Direct dependency overrides"]
    
    B --> B1["qs 6.14.1 → 6.15.0<br/>patch"]
    B --> B2["markdown-it 14.1.0 → 14.1.1<br/>patch"]
    B --> B3["lodash-es 4.17.21 → 4.17.23<br/>patch"]
    B --> B4["axios 1.13.2 → 1.13.5<br/>patch"]
    B --> B5["@isaacs/brace-expansion 5.0.0 → 5.0.1<br/>patch"]
    B --> B6["diff 7.0.0 → 8.0.3<br/>⚠️ MAJOR"]
    
    C --> C1["@modelcontextprotocol/sdk 1.25.3 → 1.26.0<br/>minor"]
    C --> C2["hono 4.11.4 → 4.11.9<br/>patch"]
    
    B6 -->|"crosses ^7.0.0 range"| D["@google/gemini-cli-core"]
    
    style B6 fill:#f9f,stroke:#f00,stroke-width:2px
    style D fill:#fdd,stroke:#f00

_{Last reviewed commit: 32ee992}