[masahiroid]

Overrides glob, minimatch and follow-redirects to patched releases (production audit is clean) and records the matching advisories of the development-only iOS driver's bundled copies as explicit, expiring exceptions.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f3e8c710-8314-40cd-a96f-8200a9415612

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Copilot]

🔵 Needs a closer look

Global glob/minimatch major-version overrides exceed Appium and WebdriverIO’s declared dependency ranges, requiring fresh-install audit and consumer compatibility validation unavailable in this review.

No open issues 🎉

What changed in this PR

Addresses production dependency advisories while keeping exceptions for bundled development-only iOS driver dependencies scoped and time-limited.

Changes:

• Pins patched releases of glob, minimatch, and follow-redirects through dependency overrides.
• Updates the lockfile with matching releases and transitive dependencies.
• Expands advisory exceptions for bundled iOS driver copies, retaining the December 31, 2026 expiry.

File	Description
scripts/​audit-gate.js	Adds path-specific advisory exceptions using shared driver-path and reason constants.
package.json	Adds overrides for three patched dependency releases.
package-lock.json	Records updated dependency versions and their transitive changes.

_{Review effort: Balanced}