Securite

[EthanThePhoenix38]

No description provided.

[Copilot]

Pull request overview

Updates dependencies to address security concerns by upgrading the openai npm package and refreshing the lockfile, along with logging the automated security update in the changelog.

Changes:

• Bumped openai dependency from ^4.76.0 to ^6.17.0.
• Regenerated package-lock.json, updating/removing transitive dependencies accordingly.
• Added “Automated Security Batch Update” entries to CHANGELOG.md.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File	Description
package.json	Updates the openai dependency version.
package-lock.json	Aligns lockfile with the new openai version and updated dependency graph.
CHANGELOG.md	Records the automated security batch update (currently duplicated across multiple releases).

Comments suppressed due to low confidence (1)

package.json:38

• Upgrading openai to v6 pulls in transitive deps with stricter Node engine requirements (e.g., undici >=20.18.1 and @exodus/bytes ^20.19.0 per the updated lockfile). The project engines.node currently allows >=20.0.0, which can lead to install/runtime failures on earlier Node 20.x. Consider bumping engines.node to at least >=20.19.0 (and regenerating the lockfile after).

    "openai": "^6.17.0",
    "rss-parser": "^3.13.0",
    "sanitize-html": "^2.17.0"
  },
  "engines": {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

These “Automated Security Batch Update” bullets are timestamped 2026-02-02 but are being added under the 1.1.0 (2026-01-31) release. This makes the changelog timeline inconsistent and duplicates similar entries elsewhere in the file. Consider moving this note to the appropriate release section (or an Unreleased section) and keeping it only once.

[Copilot]

These automated update entries are duplicated verbatim across multiple version sections. Changelogs typically record each change once under the version that contains it; duplicating the same change under 1.2.0 and other versions makes it hard to determine where the dependency bump actually shipped.

[Copilot]

Same automated security update entries are also being added under 1.0.0 (2025-12-10), which is historically far earlier than the timestamps. This should be recorded under the version that includes the dependency update (or an Unreleased section) rather than backfilled into older releases.