1.0.15

fix(deps): remove junk "23" dependency (#154 )
"23": "^0.0.0" is not a real dependency - it is an empty placeholder package (0.0.0, no deps, unrelated third-party maintainer) that landed here from a stray npm install. Nothing in the package references it. Beyond the noise, it is a small supply-chain liability: a dependency on a squatted single-number name owned by nobody we know, shipped to every consumer of speech-utils. Lint passes; full test suite passes 105/105 with live vendor credentials. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-10-03 23:33:59 +00:00 · 2026-08-06 10:23:47 -04:00 · 2026-08-06 10:23:31 -04:00 · 2026-08-06 10:13:51 -04:00 · 2026-08-06 10:13:31 -04:00
2 changed files with 5 additions and 34 deletions
@@ -1,15 +1,14 @@
 {
  "name": "@jambonz/speech-utils",
-  "version": "1.0.13",
+  "version": "1.0.15",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "@jambonz/speech-utils",
-      "version": "1.0.13",
+      "version": "1.0.15",
      "license": "MIT",
      "dependencies": {
-        "23": "^0.0.0",
        "@aws-sdk/client-polly": "^3.496.0",
        "@aws-sdk/client-sts": "^3.496.0",
        "@cartesia/cartesia-js": "^2.2.7",
@@ -20,8 +19,7 @@
        "debug": "^4.3.4",
        "google-protobuf": "^3.21.2",
        "microsoft-cognitiveservices-speech-sdk": "^1.51.0",
-        "openai": "^4.98.0",
-        "undici": "^7.5.0"
+        "openai": "^4.98.0"
      },
      "devDependencies": {
        "config": "^4.2.0",
@@ -2445,12 +2443,6 @@
        "node": ">=22.0.0"
      }
    },
-    "node_modules/23": {
-      "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/23/-/23-0.0.0.tgz",
-      "integrity": "sha512-uAETf9Okr72trtp1pNXYKhFCTTI1EKGcYMA8gw3jLGhlbaDX+grrNToEWrpt8luxRAvrZWBTvyB5wk3PpNjGQQ==",
-      "license": "ISC"
-    },
    "node_modules/abort-controller": {
      "version": "3.0.0",
      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
@@ -7066,15 +7058,6 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
-    "node_modules/undici": {
-      "version": "7.24.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.5.tgz",
-      "integrity": "sha512-3IWdCpjgxp15CbJnsi/Y9TCDE7HWVN19j1hmzVhoAkY/+CJx449tVxT5wZc1Gwg8J+P0LWvzlBzxYRnHJ+1i7Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.18.1"
-      }
-    },
    "node_modules/undici-types": {
      "version": "5.26.5",
      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
@@ -7377,11 +7360,6 @@
    }
  },
  "dependencies": {
-    "23": {
-      "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/23/-/23-0.0.0.tgz",
-      "integrity": "sha512-uAETf9Okr72trtp1pNXYKhFCTTI1EKGcYMA8gw3jLGhlbaDX+grrNToEWrpt8luxRAvrZWBTvyB5wk3PpNjGQQ=="
-    },
    "@aashutoshrathi/word-wrap": {
      "version": "1.2.6",
      "resolved": "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz",
@@ -12415,11 +12393,6 @@
        "which-boxed-primitive": "^1.0.2"
      }
    },
-    "undici": {
-      "version": "7.24.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.5.tgz",
-      "integrity": "sha512-3IWdCpjgxp15CbJnsi/Y9TCDE7HWVN19j1hmzVhoAkY/+CJx449tVxT5wZc1Gwg8J+P0LWvzlBzxYRnHJ+1i7Q=="
-    },
    "undici-types": {
      "version": "5.26.5",
      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
@@ -1,6 +1,6 @@
 {
  "name": "@jambonz/speech-utils",
-  "version": "1.0.13",
+  "version": "1.0.15",
  "description": "TTS-related speech utilities for jambonz",
  "main": "index.js",
  "author": "Dave Horton",
@@ -25,7 +25,6 @@
  },
  "homepage": "https://github.com/jambonz/speech-utils#readme",
  "dependencies": {
-    "23": "^0.0.0",
    "@aws-sdk/client-polly": "^3.496.0",
    "@aws-sdk/client-sts": "^3.496.0",
    "@cartesia/cartesia-js": "^2.2.7",
@@ -36,8 +35,7 @@
    "debug": "^4.3.4",
    "google-protobuf": "^3.21.2",
    "microsoft-cognitiveservices-speech-sdk": "^1.51.0",
-    "openai": "^4.98.0",
-    "undici": "^7.5.0"
+    "openai": "^4.98.0"
  },
  "devDependencies": {
    "config": "^4.2.0",
Author	SHA1	Message	Date
Dave Horton	d89457f67d	1.0.15	2026-08-06 10:23:47 -04:00
Dave HortonandClaude Opus 5	3c15976669	fix(deps): remove junk "23" dependency (#154 ) "23": "^0.0.0" is not a real dependency - it is an empty placeholder package (0.0.0, no deps, unrelated third-party maintainer) that landed here from a stray npm install. Nothing in the package references it. Beyond the noise, it is a small supply-chain liability: a dependency on a squatted single-number name owned by nobody we know, shipped to every consumer of speech-utils. Lint passes; full test suite passes 105/105 with live vendor credentials. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-06 10:23:31 -04:00
Dave Horton	70abb04941	1.0.14	2026-08-06 10:13:51 -04:00
Dave HortonandClaude Opus 5	724af7fcab	fix(deps): drop unused undici dependency (#153 ) undici was declared as a direct dependency but is never required anywhere in this package - grep across index.js, lib/ and stubs/ finds no reference to undici, ProxyAgent, setGlobalDispatcher or Dispatcher. The one HTTP call in lib/synth-audio.js uses the global fetch, and Azure proxy support goes through the SDK's own setProxy plus the http_proxy_ip/http_proxy_port params. Removing it clears all seven open undici advisories from npm audit for this package and its consumers, and stops speech-utils pulling a duplicate undici 7.x into trees where the consumer already depends on undici 8 (feature-server does). Lint passes; full test suite passes 105/105 with live vendor credentials. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-08-06 10:13:31 -04:00