[DPEDE-1784](deps): Bump launch-editor from 2.13.2 to 2.14.1

[dependabot]

Bumps launch-editor from 2.13.2 to 2.14.1.

Commits

• 3f97c64 v2.14.1
• 0cc9550 fix: reject UNC paths (#138)
• afd1ab9 ci: run tests on mac and windows (#136)
• 0bfa328 test: add some tests for launch-editor package (#135)
• 1b006ae chore: add README (#134)
• 383ef26 v2.14.0
• 6277209 ci: harden publish settings
• 520b2f7 fix(deps): update all non-major dependencies (#129)
• 475ac66 chore(deps): update dependency lint-staged to v17 (#130)
• 247bf1d chore(deps): update dependency yorkie to v2 (#131)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2103/1/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Minor bump of launch-editor 2.13.2→2.14.1; package is not imported in this repo, fixes GHSA-v6wh-96g9-6wx3 (NTLMv2 hash disclosure on Windows); escalated on CI health — critical checks pass at 64.3% across 28 runs.

TL;DR

• Merge: 🔍 review CI health, then merge — the dependency itself is safe; confirm the failing critical-check workflows are pre-existing and unrelated to this PR before merging.
• Breaks your code? ✅ Most likely not — launch-editor is not imported anywhere in this repo.
• Security? ✅ this bump fixes GHSA-v6wh-96g9-6wx3 (NTLMv2 hash disclosure on Windows).
• Update: launch-editor — you have 2.13.2, this PR installs 2.14.1 (minor, spans 2 releases). Fixes GHSA-v6wh-96g9-6wx3, no code impact.

Signal	Value	Interpretation
Bump type	minor	Semver minor increment (2.13.2→2.14.1); minor bumps are backward-compatible by convention — additive changes only. Transitively also bumps shell-quote 1.8.3→1.8.4 (patch).
Dependency risk	low	Minor bump with zero confirmed in-repo usage; no call site exists that could be affected. No used symbol changed because no symbol is used.
Security risk	low	This bump resolves GHSA-v6wh-96g9-6wx3 (medium, NTLMv2 hash disclosure on Windows); no advisory affects 2.14.1. GHSA-c27g-q93r-2cwf (high, command injection on Windows) was already patched in 2.9.0, predating old version 2.13.2.
CI health risk	high	Critical checks: pass 64.3%, flaky 0%, 28 runs → confidence low. The failing runs are dominated by other Dependabot update workflows (@babel/preset-env, vite, nuxt) whose CI is classified critical; Push on master passes 9/9.
API usage in repo	false	Scanned via node-scan; 0 import sites found — launch-editor is not imported in any source file in this repo.
Cross-repo signal	standalone	No publishable root manifest found at the repository root.
Data completeness	degraded	4/5 signals obtained; missing: release_notes — changelog was not retrieved; assessed from semver delta (minor = backward-compatible) and zero in-repo usage confirms no impact regardless.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low (pass rate 64.3%, 28 critical runs) — a reviewer must confirm the failing critical checks are pre-existing and unrelated to this specific PR.

Escalation category: ci-health

Confidence breakdown — score: 0.75.

• ✅ Minor bump — backward-compatible by semver convention

• ✅ No in-repo usage — blast radius is zero; no code can break on merge

• ✅ Fixes GHSA-v6wh-96g9-6wx3 — a positive security signal

• ✅ No cascade conflicts with other open Dependabot PRs

• ⚠️ Critical CI confidence low: pass rate 64.3% on 28 critical runs; failures are concentrated in other Dependabot bump workflows for @babel/preset-env, vite, and nuxt packages

• ⚠️ Release notes unavailable — assessed from semver delta only; zero usage means impact is moot regardless

• 💡 To reach a lower route: Bring the critical-check pass rate above 70% on the default branch — the failing npm_and_yarn update workflows for @babel/preset-env, vite, and nuxt are dragging the score below threshold; merging or closing those PRs would improve the baseline. Note: fixing any informational workflow will NOT change this route since such workflows are excluded from CI scoring.

What AiFEL checked

1. Triage — classified minor (launch-editor 2.13.2→2.14.1).
2. Symbol extraction — 0 import sites across 0 files; launch-editor is not imported in this repo.
3. Release-notes comparator — changelog not available; semver minor delta confirms backward-compatible; zero in-repo usage confirms no impact regardless.
4. CI health — 28 critical runs: pass 64.3%, flaky 0% → confidence low; informational excluded: none.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 4/5 signals; missing: release_notes (changelog not retrieved).

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. launch-editor is not imported anywhere in this repo's source files, so no call site exists that could be affected by this bump.

Security advisories

✅ Nothing still affects 2.14.1

✅ Resolved by this bump (1): GHSA-v6wh-96g9-6wx3 (CVE-2026-53632) — no action needed (severity: medium; CVSS score not published by the advisory).

Previously patched (before your old version): GHSA-c27g-q93r-2cwf (CVE-2024-52011, high severity, CVSS not published) — command injection via crafted request on Windows; first patched in 2.9.0, which predates your old version 2.13.2. Not a concern for this PR.

✅ This bump resolves all 1 known advisory that remained open against 2.13.x and none affect 2.14.1 — clear on the security axis.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	launch-editor	2.13.2	2.14.1	minor bump — fixes GHSA-v6wh-96g9-6wx3 (NTLMv2 hash disclosure on Windows); no code impact
npm	shell-quote (transitive)	1.8.3	1.8.4	patch bump of transitive dep — no direct code impact

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "minor",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "degraded",
  "escalate_reason": "risk",
  "missing_signals": [
    {
      "signal": "release_notes",
      "reason": "changelog not retrieved by pre-step; assessed from semver delta (minor bump = backward-compatible) and zero in-repo usage"
    }
  ],
  "confidence": 0.75,
  "packages": [
    {
      "ecosystem": "npm",
      "name": "launch-editor",
      "old_version": "2.13.2",
      "new_version": "2.14.1"
    }
  ],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Minor bump of launch-editor 2.13.2→2.14.1; package unused in this repo, fixes GHSA-v6wh-96g9-6wx3 (NTLMv2 hash disclosure on Windows); escalated on CI health (pass rate 64.3%, 28 critical runs).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2103",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience