Merge pull request #12 from pacnpal/claude/fix-npm-vulnerabilities-01HXeybQPavyJpWugp4n2j4s

Resolve npm security vulnerabilities and deprecated packages
Fix npm security vulnerabilities using package overrides
2025-12-27 07:26:57 -05:00 · 2025-11-14 10:36:00 -05:00 · 2025-11-14 15:33:30 +00:00 · 2025-11-14 10:24:30 -05:00 · 2025-11-14 15:23:47 +00:00 · 2025-11-14 10:16:59 -05:00
6 changed files with 256 additions and 58 deletions
--- a/README.md
+++ b/README.md
@@ -2,6 +2,8 @@

 ![GitHub](https://img.shields.io/github/license/pacnpal/claude-code-review)
 ![GitHub Actions Workflow Status](https://img.shields.io/badge/actions-passing-brightgreen)
+![Claude](https://img.shields.io/badge/Claude-Sonnet%204.5-blue)
+![Node](https://img.shields.io/badge/node-20-green)

 A GitHub Action that performs automated code reviews using Claude Sonnet 4.5, Anthropic's latest AI model for code analysis.

@@ -22,14 +24,18 @@ A GitHub Action that performs automated code reviews using Claude Sonnet 4.5, An
 - [Inputs](#inputs)
 - [Outputs](#outputs)
 - [Review Format](#review-format)
+- [Technical Details](#technical-details)
+- [Limitations](#limitations)
+- [Troubleshooting](#troubleshooting)
 - [Development](#development)
 - [Contributing](#contributing)
+- [FAQ](#frequently-asked-questions)
 - [License](#license)
 - [Support](#support)

 ## Features

- 🤖 **AI-Powered Reviews**: Leverages Claude Sonnet 4.5 for intelligent code analysis
+- 🤖 **AI-Powered Reviews**: Leverages Claude Sonnet 4.5 (claude-sonnet-4-5-20250929) for intelligent code analysis
 - 🔍 **Comprehensive Analysis**: Examines code changes in pull requests thoroughly
 - 💡 **Detailed Feedback**: Provides actionable feedback on code quality and structure
 - 🐛 **Bug Detection**: Identifies potential issues and suggests improvements
@@ -37,6 +43,8 @@ A GitHub Action that performs automated code reviews using Claude Sonnet 4.5, An
 - ⚡ **Performance Insights**: Highlights performance implications of code changes
 - 📋 **Best Practices**: Ensures adherence to coding standards and best practices
 - 🎯 **Severity Ratings**: Categorizes issues by severity (Critical/High/Medium/Low)
+- 🔄 **Automatic Retries**: Built-in retry logic with exponential backoff for reliability
+- ⏱️ **Rate Limit Handling**: Automatically manages API rate limits

 ## Usage

@@ -87,6 +95,32 @@ For existing pull requests, you can manually trigger the review:
 3. Fill in the branch and pull request number
 4. Click "Run Workflow"

+### Disabling Auto-Review
+
+You can disable automatic reviews and only use manual triggers by setting `auto-review: false`:
+
+```yaml
+- name: Run Claude Review
+  uses: pacnpal/claude-code-review@main
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    anthropic-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    pr-number: ${{ github.event.pull_request.number || inputs.pr_number }}
+    auto-review: false  # Disables automatic reviews
+```
+
+You can also make it conditional based on labels or other criteria:
+
+```yaml
+- name: Run Claude Review
+  uses: pacnpal/claude-code-review@main
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    anthropic-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    pr-number: ${{ github.event.pull_request.number || inputs.pr_number }}
+    auto-review: ${{ contains(github.event.pull_request.labels.*.name, 'needs-review') }}
+```
+
 ## Setup

 ### Prerequisites
@@ -108,9 +142,15 @@ For existing pull requests, you can manually trigger the review:
   - The `GITHUB_TOKEN` is automatically provided by GitHub Actions
   - No additional configuration needed

-3. **Set Permissions** (if needed):
+3. **Set Permissions**:
   - Ensure your workflow has proper permissions (see Usage example above)
   - Required permissions: `contents: read` and `pull-requests: write`
+   - For organization repositories, you may need to enable workflows to create/approve pull requests in Settings
+
+4. **Optional: Environment Protection**:
+   - For additional security, create a GitHub Environment (e.g., `development_environment`)
+   - Add `ANTHROPIC_API_KEY` as an environment secret instead of repository secret
+   - This provides additional control and approval gates for sensitive operations

 ## Inputs

@@ -119,6 +159,7 @@ For existing pull requests, you can manually trigger the review:
 | `github-token` | GitHub token for API access | Yes | N/A |
 | `anthropic-key` | Anthropic API key for Claude | Yes | N/A |
 | `pr-number` | Pull request number to review | Yes | N/A |
+| `auto-review` | Enable automatic code reviews (set to `false` to skip) | No | `true` |

 ## Outputs

@@ -145,6 +186,90 @@ Each issue found includes:
 - Specific recommendations
 - Code examples where helpful

+## Technical Details
+
+### Model Configuration
+
+- **Model**: Claude Sonnet 4.5 (`claude-sonnet-4-5-20250929`)
+- **Max Tokens**: 4096 tokens per review
+- **Temperature**: 0.7 for balanced creativity and consistency
+- **Context**: 10 lines of context around each change (git diff -U10)
+
+### Reliability Features
+
+**Automatic Retry Logic**:
+- Network failures are automatically retried up to 4 times
+- Exponential backoff strategy (2s, 4s, 8s, 16s delays)
+- Non-retryable errors (401, 403, 400) fail immediately
+
+**Timeout Protection**:
+- API requests timeout after 2 minutes
+- Prevents hanging workflows on slow responses
+
+**Rate Limit Handling**:
+- Automatically respects `Retry-After` headers
+- Graceful handling of 429 rate limit responses
+
+### Diff Size Limits
+
+- **Maximum Diff Size**: ~100KB (100,000 bytes)
+- Large diffs are automatically truncated with a notice
+- Helps stay within API token limits and ensures fast reviews
+
+## Limitations
+
+- **Diff Size**: Changes larger than ~100KB will be truncated
+- **Review Timeout**: Reviews exceeding 2 minutes will timeout
+- **PR State**: Can review closed PRs, but a warning is logged
+- **File Types**: All text-based files are analyzed; binary files in diffs are ignored
+- **API Costs**: Each review consumes Anthropic API credits based on diff size
+
+## Troubleshooting
+
+### Common Issues
+
+**Issue**: "Failed to get PR details"
+- **Solution**: Ensure `GITHUB_TOKEN` has `pull-requests: read` permission
+- **Solution**: Verify the PR number is correct
+
+**Issue**: "anthropic-key does not match expected format"
+- **Solution**: Verify your API key starts with `sk-ant-`
+- **Solution**: Check for extra spaces or newlines in the secret
+
+**Issue**: "Diff is empty - no changes found"
+- **Solution**: This is expected when comparing identical commits
+- **Solution**: Ensure the PR has actual code changes
+
+**Issue**: "Rate limited" or 429 errors
+- **Solution**: The action will automatically retry with backoff
+- **Solution**: Consider reducing review frequency if you hit limits often
+- **Solution**: Check your Anthropic API rate limits and quotas
+
+**Issue**: "API request timed out"
+- **Solution**: This may happen with very large diffs (>100KB)
+- **Solution**: Break large PRs into smaller, more focused changes
+- **Solution**: The action will automatically truncate diffs that are too large
+
+**Issue**: Action fails with authentication errors
+- **Solution**: Verify `ANTHROPIC_API_KEY` is set correctly in repository secrets
+- **Solution**: Ensure the API key is active and not expired
+- **Solution**: Check that your Anthropic account has available credits
+
+### Debug Mode
+
+To enable verbose logging, add this to your workflow:
+
+```yaml
+- name: Run Claude Review
+  uses: pacnpal/claude-code-review@main
+  with:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    anthropic-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    pr-number: ${{ github.event.pull_request.number }}
+  env:
+    ACTIONS_STEP_DEBUG: true
+```
+
 ## Example Review

 ```markdown
@@ -221,6 +346,68 @@ Contributions are welcome! Please:
 4. Run tests
 5. Submit a pull request

+## Frequently Asked Questions
+
+### How much does it cost?
+
+The action is free, but you'll need an Anthropic API subscription. Costs vary based on:
+- Diff size (larger diffs = more tokens)
+- Review frequency (more PRs = more API calls)
+- Current Claude API pricing (check [Anthropic's pricing](https://www.anthropic.com/pricing))
+
+Typical small PR review (~1-2KB diff) costs a few cents.
+
+### Can I use this with private repositories?
+
+Yes! The action works with both public and private repositories. Just ensure:
+- GitHub Actions is enabled for your repository
+- You've added the `ANTHROPIC_API_KEY` secret
+- Workflow permissions are properly configured
+
+### Will this slow down my CI/CD pipeline?
+
+The action runs asynchronously and doesn't block other checks. Typical review times:
+- Small PRs (<10KB): 10-30 seconds
+- Medium PRs (10-50KB): 30-60 seconds
+- Large PRs (50-100KB): 60-120 seconds
+
+You can also use `auto-review: false` to only run reviews on-demand.
+
+### Can I customize the review criteria?
+
+Currently, the review criteria are built into the action. Future versions may support custom prompts. You can:
+- Fork the repository and modify `action.js` to customize the prompt
+- Use the review as a baseline and add custom checks with other actions
+
+### Does it support languages other than English?
+
+The action's prompts are in English, but Claude can analyze code in any programming language. Review comments will be in English.
+
+### What happens if my diff is too large?
+
+Diffs larger than ~100KB are automatically truncated. A notice is added to the review indicating truncation. For large PRs:
+- Consider breaking them into smaller, focused changes
+- The most important changes (first ~100KB) will still be reviewed
+
+### Can I run this on forked PRs?
+
+Yes, but be cautious with secrets. Use GitHub's `pull_request_target` event with proper security:
+- Don't expose secrets to untrusted code
+- Consider requiring manual approval for fork PRs
+- Review GitHub's [security hardening guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
+
+### How do I prevent reviews on draft PRs?
+
+Add a condition to your workflow:
+
+```yaml
+jobs:
+  code-review:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    # ... rest of job
+```
+
 ## License

 MIT License - see the [LICENSE](LICENSE) file for details
--- a/action.js
+++ b/action.js
@@ -424,6 +424,15 @@ async function run() {
    const token = core.getInput('github-token', { required: true });
    const anthropicKey = core.getInput('anthropic-key', { required: true });
    let prNumber = core.getInput('pr-number');
+    const autoReview = core.getInput('auto-review', { required: false }) || 'true';
+
+    // Check if auto-review is disabled
+    if (autoReview.toLowerCase() === 'false') {
+      core.info('⏭️  Auto-review is disabled, skipping code review');
+      core.setOutput('diff_size', '0');
+      core.setOutput('review', 'Auto-review disabled');
+      return;
+    }

    // Get PR number from event if not provided
    const context = github.context;
--- a/action.yml
+++ b/action.yml
@@ -11,6 +11,10 @@ inputs:
  pr-number:
    description: 'Pull request number'
    required: true
+  auto-review:
+    description: 'Enable automatic code reviews (set to false to skip review)'
+    required: false
+    default: 'true'
 outputs:
  diff_size:
    description: 'Size of the relevant code changes'
--- a/dist/index.js
+++ b/dist/index.js
@@ -32260,6 +32260,15 @@ async function run() {
    const token = core.getInput('github-token', { required: true });
    const anthropicKey = core.getInput('anthropic-key', { required: true });
    let prNumber = core.getInput('pr-number');
+    const autoReview = core.getInput('auto-review', { required: false }) || 'true';
+
+    // Check if auto-review is disabled
+    if (autoReview.toLowerCase() === 'false') {
+      core.info('⏭️  Auto-review is disabled, skipping code review');
+      core.setOutput('diff_size', '0');
+      core.setOutput('review', 'Auto-review disabled');
+      return;
+    }

    // Get PR number from event if not provided
    const context = github.context;
--- a/package-lock.json
+++ b/package-lock.json
@@ -26,6 +26,7 @@
      "version": "1.11.1",
      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "license": "MIT",
      "dependencies": {
        "@actions/exec": "^1.1.1",
        "@actions/http-client": "^2.0.1"
@@ -35,6 +36,7 @@
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
+      "license": "MIT",
      "dependencies": {
        "@actions/io": "^1.0.1"
      }
@@ -43,6 +45,7 @@
      "version": "6.0.1",
      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.1.tgz",
      "integrity": "sha512-xbZVcaqD4XnQAe35qSQqskb3SqIAfRyLBrHMd/8TuL7hJSz2QtbDwnNM8zWx4zO5l2fnGtseNE3MbEvD7BxVMw==",
+      "license": "MIT",
      "dependencies": {
        "@actions/http-client": "^2.2.0",
        "@octokit/core": "^5.0.1",
@@ -57,6 +60,7 @@
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",
        "undici": "^5.25.4"
@@ -65,7 +69,8 @@
    "node_modules/@actions/io": {
      "version": "1.1.3",
      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
+      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
+      "license": "MIT"
    },
    "node_modules/@babel/code-frame": {
      "version": "7.27.1",
@@ -98,7 +103,6 @@
      "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.27.1",
        "@babel/generator": "^7.28.5",
@@ -602,6 +606,7 @@
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
+      "license": "MIT",
      "engines": {
        "node": ">=14"
      }
@@ -661,30 +666,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
    "node_modules/@istanbuljs/schema": {
      "version": "0.1.3",
      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
@@ -1181,6 +1162,7 @@
      "version": "4.0.0",
      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "license": "MIT",
      "engines": {
        "node": ">= 18"
      }
@@ -1189,7 +1171,7 @@
      "version": "5.2.2",
      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
-      "peer": true,
+      "license": "MIT",
      "dependencies": {
        "@octokit/auth-token": "^4.0.0",
        "@octokit/graphql": "^7.1.0",
@@ -1207,6 +1189,7 @@
      "version": "9.0.6",
      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/types": "^13.1.0",
        "universal-user-agent": "^6.0.0"
@@ -1219,6 +1202,7 @@
      "version": "7.1.1",
      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
      "integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/request": "^8.4.1",
        "@octokit/types": "^13.0.0",
@@ -1231,12 +1215,14 @@
    "node_modules/@octokit/openapi-types": {
      "version": "24.2.0",
      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg=="
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest": {
      "version": "9.2.2",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
      "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/types": "^12.6.0"
      },
@@ -1250,12 +1236,14 @@
    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
      "version": "20.0.0",
      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
    },
    "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
      "version": "12.6.0",
      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/openapi-types": "^20.0.0"
      }
@@ -1264,6 +1252,7 @@
      "version": "10.4.1",
      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/types": "^12.6.0"
      },
@@ -1277,12 +1266,14 @@
    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
      "version": "20.0.0",
      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA=="
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
+      "license": "MIT"
    },
    "node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
      "version": "12.6.0",
      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/openapi-types": "^20.0.0"
      }
@@ -1291,6 +1282,7 @@
      "version": "8.4.1",
      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
      "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/endpoint": "^9.0.6",
        "@octokit/request-error": "^5.1.1",
@@ -1305,6 +1297,7 @@
      "version": "5.1.1",
      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/types": "^13.1.0",
        "deprecation": "^2.0.0",
@@ -1318,6 +1311,7 @@
      "version": "13.10.0",
      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
      "dependencies": {
        "@octokit/openapi-types": "^24.2.0"
      }
@@ -1771,6 +1765,7 @@
      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.4.tgz",
      "integrity": "sha512-8LwjnlP39s08C08J5NstzriPvW1SP8Zfpp1BvC2sI35kPeZnHfxVkCwu4/+Wodgnd60UtT1n8K8zw+Mp7J9JmQ==",
      "dev": true,
+      "license": "MIT",
      "bin": {
        "ncc": "dist/ncc/cli.js"
      }
@@ -1958,7 +1953,8 @@
    "node_modules/before-after-hook": {
      "version": "2.2.3",
      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
-      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ=="
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
+      "license": "Apache-2.0"
    },
    "node_modules/brace-expansion": {
      "version": "2.0.2",
@@ -2003,7 +1999,6 @@
        }
      ],
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.8.25",
        "caniuse-lite": "^1.0.30001754",
@@ -2272,6 +2267,7 @@
      "version": "4.0.1",
      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
      "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==",
+      "license": "MIT",
      "engines": {
        "node": ">= 12"
      }
@@ -2322,7 +2318,8 @@
    "node_modules/deprecation": {
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
+      "license": "ISC"
    },
    "node_modules/detect-newline": {
      "version": "3.1.0",
@@ -2396,20 +2393,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
    "node_modules/execa": {
      "version": "5.1.1",
      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
@@ -2500,6 +2483,7 @@
          "url": "https://paypal.me/jimmywarting"
        }
      ],
+      "license": "MIT",
      "dependencies": {
        "node-domexception": "^1.0.0",
        "web-streams-polyfill": "^3.0.3"
@@ -2555,6 +2539,7 @@
      "version": "4.0.10",
      "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
      "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==",
+      "license": "MIT",
      "dependencies": {
        "fetch-blob": "^3.1.2"
      },
@@ -3879,6 +3864,7 @@
          "url": "https://paypal.me/jimmywarting"
        }
      ],
+      "license": "MIT",
      "engines": {
        "node": ">=10.5.0"
      }
@@ -3887,6 +3873,7 @@
      "version": "3.3.2",
      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
+      "license": "MIT",
      "dependencies": {
        "data-uri-to-buffer": "^4.0.0",
        "fetch-blob": "^3.1.4",
@@ -3941,6 +3928,7 @@
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
      "dependencies": {
        "wrappy": "1"
      }
@@ -4297,13 +4285,6 @@
        "source-map": "^0.6.0"
      }
    },
-    "node_modules/sprintf-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
    "node_modules/stack-utils": {
      "version": "2.0.6",
      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz",
@@ -4605,6 +4586,7 @@
      "version": "0.0.6",
      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
+      "license": "MIT",
      "engines": {
        "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
      }
@@ -4636,6 +4618,7 @@
      "version": "5.29.0",
      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
      "dependencies": {
        "@fastify/busboy": "^2.0.0"
      },
@@ -4653,7 +4636,8 @@
    "node_modules/universal-user-agent": {
      "version": "6.0.1",
      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
-      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ=="
+      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
+      "license": "ISC"
    },
    "node_modules/unrs-resolver": {
      "version": "1.11.1",
@@ -4750,6 +4734,7 @@
      "version": "3.3.3",
      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
+      "license": "MIT",
      "engines": {
        "node": ">= 8"
      }
@@ -4860,7 +4845,8 @@
    "node_modules/wrappy": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
    },
    "node_modules/write-file-atomic": {
      "version": "5.0.1",
--- a/package.json
+++ b/package.json
@@ -27,5 +27,8 @@
    "@vercel/ncc": "^0.38.4",
    "jest": "^30.2.0",
    "js-yaml": "^4.1.1"
+  },
+  "overrides": {
+    "js-yaml": "^4.1.1"
  }
 }
Author	SHA1	Message	Date
pacnpal	b9e6f2771a	Merge pull request #12 from pacnpal/claude/fix-npm-vulnerabilities-01HXeybQPavyJpWugp4n2j4s Resolve npm security vulnerabilities and deprecated packages	2025-11-14 10:36:00 -05:00
Claude	f7570c7b51	Fix npm security vulnerabilities using package overrides Resolved all 27 npm security vulnerabilities by: - Adding npm overrides to force js-yaml@^4.1.1 across all dependencies - Rebuilding package-lock.json with clean install - Fixed vulnerabilities in: braces, form-data, js-yaml, node-notifier, tough-cookie All vulnerabilities resolved: 0 vulnerabilities remaining	2025-11-14 15:33:30 +00:00
pacnpal	9b21586040	Merge pull request #11 from pacnpal/claude/update-the-016vQNNAoTQnD6jiz9SwW3Fb Update the codebase	2025-11-14 10:24:30 -05:00
Claude	ffacd0a72a	Enhance README with comprehensive documentation improvements - Add Claude Sonnet 4.5 and Node 20 badges - Document technical details: model config, retry logic, timeouts - Add Limitations section covering diff size, timeouts, and costs - Add comprehensive Troubleshooting section with common issues - Add FAQ section answering common user questions - Expand Setup with environment protection guidance - Update Table of Contents with new sections - Clarify feature list with retry and rate limit handling	2025-11-14 15:23:47 +00:00
pacnpal	7000f3c840	Merge pull request #10 from pacnpal/claude/auto-pr-review-01RhWKxVsrwj27rznVTBz9mC Set up automatic pull request review	2025-11-14 10:16:59 -05:00
Claude	9d3fe9dc92	Update package-lock.json after npm install	2025-11-14 15:16:39 +00:00
Claude	91d2ef3fcf	Add optional auto-review parameter - Add auto-review input parameter (defaults to true for backward compatibility) - Skip code review when auto-review is set to false - Update README with usage examples for disabling auto-review - Support conditional reviews based on labels or other criteria	2025-11-14 15:16:06 +00:00
pacnpal	9a80f461e3	Merge pull request #9 from pacnpal/claude/update-trh-01XGpTP9SyZyY7eG3zcnXHZN Update TRH Component	2025-11-14 10:11:09 -05:00