[ajaynes-godaddy]

Summary

Pins semver-regex to 3.1.4, resolving Dependabot's security update that was otherwise stuck on an unpatchable semver-regex@1.0.0.

Details

• This was flagged by Dependabot's periodic update job, not a code-scanning alert — it's being fixed here manually, outside a Dependabot-authored PR, because that job couldn't produce one: no valid install resolves the constraint to a patched version, so Dependabot just logs the conflict and gives up rather than opening a PR.
• gulp-imagemin's imagemin-gifsicle → gifsicle → bin-wrapper/bin-build chain pulls in find-versions@3.2.0, which pins semver-regex@^2.0.0 — a range with no patched release (the fix landed in 3.1.4).
• Only one semver-regex copy exists in the whole tree, and it isn't a direct dependency here, so a blanket override was safe without any EOVERRIDE conflict or need for chain-scoping.
• Deliberately pinned to 3.1.4 rather than latest (4.0.5): semver-regex went ESM-only ("type": "module", no CommonJS entry point) starting at 4.0.0, which would break find-versions' require('semver-regex') call outright. 3.1.4 is the last release still on the stable CommonJS module.exports = () => regex shape — identical across 2.0.0 and 3.1.4, confirmed by diffing both versions' index.js.
• Verified find-versions (the real consumer) still extracts version strings correctly from a sample string against the overridden semver-regex.
• This repo has two open Dependabot alerts for semver-regex: alert 13 (high, CVE-2021-3795, patched at 3.1.3) and alert 17 (low, CVE-2021-43307, patched at 3.1.4) — 3.1.4 clears both and they should auto-resolve once this merges.

QA

Steps

1. Install dependencies on this branch and confirm the install succeeds:

   npm install

   • Confirm the install completes with exit code 0
2. Confirm there's exactly one semver-regex copy in the tree, resolved to the patched version:

   find node_modules -type d -iname semver-regex
   node -p "require('./node_modules/semver-regex/package.json').version"

   • Confirm the output is:

     node_modules/semver-regex
     3.1.4
     

3. Confirm find-versions (the real consumer) still extracts version strings correctly against the overridden semver-regex:

   node -e "
   const findVersions = require('./node_modules/find-versions');
   console.log(findVersions('gulp-imagemin v9.2.0 upgraded from v8.1.0', {loose: true}));
   "

   • Confirm the output is:

     [ '9.2.0', '8.1.0' ]
     

Before merge

• This PR makes the appropriate modifications to automated tests or explains why none are needed — pure transitive dependency pin with no behavior change to this repo's own code; verified via the QA steps above and the existing test suite (npm test) still passes.
• This PR makes the appropriate modifications to documentation or explains why none are needed
• This change does not impact usage or expected outputs of covered code — pure transitive dependency pin, confirmed via the QA steps above.
• I've bumped the AI Assistant framework version if one is available

🤖 Generated with Claude Code