[ajaynes-godaddy]

Summary

Pins http-cache-semantics to 4.3.0, resolving Dependabot's security update that was otherwise stuck on an unpatchable http-cache-semantics@3.8.1.

Details

• This was flagged by Dependabot's periodic update job, not a code-scanning alert — it's being fixed here manually, outside a Dependabot-authored PR, because that job couldn't produce one: no valid install resolves the constraint to a patched version, so Dependabot just logs the conflict and gives up rather than opening a PR.
• gulp-imagemin's imagemin-gifsicle → gifsicle → bin-wrapper → download → got@8.3.2 chain pulls in got's own internal HTTP-caching layer, cacheable-request@2.1.4, which pins http-cache-semantics@3.8.1 — a version with no patched release in its line (the fix landed in 4.1.1, with a second, separate advisory fixed above 4.2.0).
• http-cache-semantics isn't a direct dependency here and only one copy exists in the tree, so a blanket override was safe without any EOVERRIDE conflict.
• This package is three layers removed from any code this repo controls — it's an internal implementation detail of got's caching logic, not something download/gifsicle call directly. Diffed the CachePolicy class between 3.8.1 and 4.3.0: the constructor reads the exact same req.url/req.headers/res.headers/res.status shape in both versions, and every method cacheable-request@2.1.4 actually calls (storable, toObject, timeToLive, fromObject, satisfiesWithoutRevalidation, responseHeaders, revalidationHeaders, revalidatedPolicy) exists unchanged in 4.3.0.
• Verified by running a real HTTP request through cacheable-request with each version forced in isolation — byte-identical response body both times, no errors.
• This repo has two open Dependabot alerts for http-cache-semantics: alert 19 (high, CVE-2022-25881, patched at 4.1.1) and alert 194 (high, CVE-2026-93748, vulnerable through 4.2.0) — 4.3.0 clears both and they should auto-resolve once this merges.

QA

Steps

1. Install dependencies on this branch and confirm the install succeeds:

   npm install

   • Confirm the install completes with exit code 0
2. Confirm there's exactly one http-cache-semantics copy in the tree, resolved to the patched version:

   node -p "require('./node_modules/http-cache-semantics/package.json').version"

   • Confirm the output is:

     4.3.0
     

3. Confirm cacheable-request (the real consumer, used internally by got) still issues and completes a request correctly against the overridden http-cache-semantics:

   node -e "
   const CacheableRequest = require('./node_modules/cacheable-request');
   const http = require('http');
   const server = http.createServer((req, res) => { res.setHeader('cache-control', 'max-age=60'); res.end('hello world'); });
   server.listen(0, () => {
     const port = server.address().port;
     const cacheableRequest = new CacheableRequest(http.request);
     const req = cacheableRequest(\`http://localhost:\${port}\`, response => {
       let body = '';
       response.on('data', c => body += c);
       response.on('end', () => { console.log('body:', body); server.close(); });
     });
     req.on('request', r => r.end());
     req.on('error', err => { console.error('FAILED:', err); process.exit(1); });
   });
   "

   • Confirm the output is:

     body: hello world
     

Before merge

• This PR makes the appropriate modifications to automated tests or explains why none are needed — pure transitive dependency pin with no behavior change to this repo's own code; verified via the QA steps above and the existing test suite (npm test) still passes.
• This PR makes the appropriate modifications to documentation or explains why none are needed
• This change does not impact usage or expected outputs of covered code — pure transitive dependency pin, confirmed via the QA steps above.
• I've bumped the AI Assistant framework version if one is available

🤖 Generated with Claude Code