From a0a88d6efc37523ba38cfb2c2c8e5365f07dabd3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 13:35:57 +0000
Subject: [PATCH 1/2] Bump flatted from 3.3.3 to 3.4.2 in /webapp

Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 webapp/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/webapp/package-lock.json b/webapp/package-lock.json
index 0f73163d..66a386c5 100644
--- a/webapp/package-lock.json
+++ b/webapp/package-lock.json
@@ -6764,9 +6764,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },

From 2ef52251d04973b040ed099207170225e2ab649e Mon Sep 17 00:00:00 2001
From: Nevyana Angelova <nevyangelova@192.168.100.24>
Date: Mon, 23 Mar 2026 15:34:25 +0200
Subject: [PATCH 2/2] Exclude webapp/node_modules from go vet scans

Third-party npm packages (e.g. flatted v3.4.2) can ship .go files
that fail the Mattermost license header check. Filter go vet to
only scan server packages.

Made-with: Cursor
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index f66281c1..652e1cd0 100644
--- a/Makefile
+++ b/Makefile
@@ -197,9 +197,9 @@ endif
 # weird reports at golangci-lint step
 ifneq ($(HAS_SERVER),)
 	@echo Running golangci-lint
-	$(GO) vet ./...
+	$(GO) vet $$($(GO) list ./... | grep -v /webapp/)
 	$(GOBIN)/golangci-lint run ./...
-	$(GO) vet -vettool=$(GOBIN)/mattermost-govet -license -license.year=2017 ./...
+	$(GO) vet -vettool=$(GOBIN)/mattermost-govet -license -license.year=2017 $$($(GO) list ./... | grep -v /webapp/)
 endif
 
 ## Builds the server, if it exists, for all supported architectures, unless MM_SERVICESETTINGS_ENABLEDEVELOPER is set.