[danny-avila]

Pull Request Template

⚠️ Before Submitting a PR, Please Review:

• Please ensure that you have thoroughly read and understood the Contributing Docs before submitting your Pull Request.

⚠️ Documentation Updates Notice:

• Kindly note that documentation updates are managed in this repository: librechat.ai

Summary

Dependabot alerts here only ever covered what package.json lists. GitHub's dependency graph reads package-lock.json, yarn.lock and pnpm-lock.yaml, but not bun.lock (supported ecosystems). Before this PR, the repository's dependency graph held 72 entries, mostly version ranges taken from package.json (react ^19.3.1), and none of the roughly 750 transitive packages bun.lock installs.

• So a vulnerable transitive package raised no alert. For example, @tanstack/start-server-core is only pinned through overrides.
• The open minimatch advisory (GHSA-g3hv-75wg-m249) that bun audit reports never showed up as an alert either.

The fix: submit bun.lock through the dependency submission API. Dependabot alerts cover submitted packages like any others.

• The new Dependency Graph workflow (.github/workflows/dependency-graph.yml) builds a snapshot and posts it with gh api. It runs on every push to main that changes bun.lock, package.json, the script or the workflow, and on demand.
  • It needs contents: write, which the API requires.
  • A newer run cancels an older one, so an older snapshot can't land after a newer one.
• scripts/dependencies.ts reads bun.lock with Bun.JSONC and prints the snapshot:
  • Each registry package appears once per exact version: 815 today, from 927 lockfile entries.
  • direct means package.json lists it.
  • runtime means a runtime dependency reaches it, through dependencies, optionalDependencies or peerDependencies; otherwise it's development.
  • Each package also records the exact versions it depends on.
  • Nested copies (@babel/core/semver) resolve the way Node does, nearest node_modules first.
  • The local ESLint plugin (file:tools/…) has no registry version, so it's left out, but its edges still count toward scopes.
  • Its logic is a pure function (resolveManifest, toSnapshot), tested in Vitest. The Bun-only part just reads the lockfile and prints.

Change Type

• New feature (non-breaking change which adds functionality)

Testing

• scripts/dependencies.test.ts (8 tests) runs on a small lockfile with real entry shapes and checks:

  • one entry per version;
  • file dependencies skipped;
  • direct and transitive packages with their scopes;
  • a package reached from both sides counted as runtime;
  • optional and peer edges followed;
  • a nested copy resolved before the top-level one;
  • a version at two paths keeping its strongest relationship and scope;
  • + in a version encoded in the package URL;
  • the submission body.

• On this repository's bun.lock, the script resolves 815 packages:

  	Packages
  Direct, runtime	41
  Direct, development	21
  Transitive, runtime	446
  Transitive, development	307

  • The 62 direct packages are package.json's 63 minus the local plugin.
  • There are no malformed package URLs, and every dependency edge points at a submitted package.
  • Spot checks: react@19.3.1 (direct, runtime), @tanstack/start-server-core@1.169.45 (transitive, runtime), and minimatch@3.1.5 and @10.2.6 (transitive, development).

• I submitted the snapshot to this repository for this PR's branch. GitHub answered ACCEPTED, and said a snapshot for a branch other than the default doesn't change the repository's results.

• npx tsc --noEmit (it covers scripts/) and Prettier pass, and the workflow parses as YAML.

• After this merges, I'll check that the workflow's first run on main is accepted, that the dependency graph grows from 72 entries to the lockfile's packages, and that Dependabot opens an alert for the minimatch advisory bun audit already reports.

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

Pass 1. Head: 2475261

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T14:17:51.378814Z	2475261	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 2475261b70

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Monkeybomb31]

Hey og