From 0a7554edf2d72d290bce2658d3b91ce45120ad42 Mon Sep 17 00:00:00 2001 From: goetchstone Date: Tue, 28 Jul 2026 06:01:52 -0400 Subject: [PATCH 1/2] Deps: pnpm overrides for the two dependabot alerts (js-yaml, brace-expansion) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - js-yaml >=4.3.0 (high: vulnerable range >=4.0.0 <4.3.0) — only one version in the tree (4.2.0), pulled in by @eslint/eslintrc; resolves to 4.3.0, same major line. - brace-expansion >=5.0.7 (high: vulnerable range >=3.0.0 <5.0.7), scoped as "minimatch@10>brace-expansion" — the tree carries TWO incompatible major lines: 1.1.15 (bare-function export) under minimatch@3.1.5 via eslint's own config-array/eslintrc chain, and 5.0.6 (named exports) under minimatch@10.2.5 via @typescript-eslint/typescript-estree. Only the 5.x line is in the advisory's vulnerable range, so the override is qualified to that parent to avoid forcing a major bump onto minimatch@3.1.5 (which would break it the way an unscoped bump broke minimatch@3.x/ @babel/core/istanbul on a sibling repo). Resolves to 5.0.8; the 1.1.15 instance is untouched and out of the alert's range. Full gate green with the new resolutions (1,245 tests, lint, build). `pnpm audit` confirms both js-yaml and the 5.x brace-expansion finding are gone; the untouched 1.x brace-expansion instance and a pre-existing postcss advisory in packages/client are unrelated to these two alerts and were left alone. Co-Authored-By: Claude Fable 5 --- package.json | 4 +++- pnpm-lock.yaml | 20 +++++++++++--------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/package.json b/package.json index 4344273..0a78c38 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,9 @@ ], "overrides": { "shell-quote": ">=1.8.4", - "esbuild": ">=0.28.1" + "esbuild": ">=0.28.1", + "js-yaml": "^4.3.0", + "minimatch@10>brace-expansion": "^5.0.7" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b6782e7..961a969 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,8 @@ settings: overrides: shell-quote: '>=1.8.4' esbuild: '>=0.28.1' + js-yaml: ^4.3.0 + minimatch@10>brace-expansion: ^5.0.7 importers: @@ -614,9 +616,9 @@ packages: brace-expansion@1.1.15: resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.8: + resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + engines: {node: 20 || >=22} cac@6.7.14: resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==} @@ -852,8 +854,8 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true json-buffer@3.0.1: @@ -1324,7 +1326,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.0 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -1624,7 +1626,7 @@ snapshots: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.6: + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -1869,7 +1871,7 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@4.2.0: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -1902,7 +1904,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.8 minimatch@3.1.5: dependencies: From 45de9a3a32f6a3ab27888894dab9a4992f177169 Mon Sep 17 00:00:00 2001 From: goetchstone Date: Tue, 28 Jul 2026 06:06:14 -0400 Subject: [PATCH 2/2] security(deps): also clear the 1.x brace-expansion and postcss advisories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to the js-yaml / brace-expansion@5 overrides in this branch. - minimatch@3>brace-expansion -> ^1.1.16 clears GHSA-3jxr-9vmj-r5cp. Scoped to the 1.x line so minimatch@3's bare-function usage keeps working; a blanket brace-expansion override would break it (and @babel/core and istanbul), which is exactly how the equivalent bump failed on a sibling repo. - postcss -> ^8.5.18 clears the sourceMappingURL path-traversal advisory reaching packages/client via vite. Remaining after this: GHSA-mh99-v99m-4gvg still matches brace-expansion 1.1.16 under eslint>minimatch@3. It is unfixable — the advisory covers everything <= 5.0.7 and upstream patched only the 5.x line, so no patched 1.x exists — and it is dev-only. 'pnpm audit --prod' reports no known vulnerabilities, so nothing vulnerable ships. Verified on a clean 'pnpm install --frozen-lockfile': build, lint, and the full workspace suite all pass. Co-Authored-By: Claude Opus 4.8 --- package.json | 4 +++- pnpm-lock.yaml | 26 ++++++++++++++------------ 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/package.json b/package.json index 0a78c38..6eb06f5 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,9 @@ "shell-quote": ">=1.8.4", "esbuild": ">=0.28.1", "js-yaml": "^4.3.0", - "minimatch@10>brace-expansion": "^5.0.7" + "minimatch@10>brace-expansion": "^5.0.7", + "minimatch@3>brace-expansion": "^1.1.16", + "postcss": "^8.5.18" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 961a969..08d3171 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,6 +9,8 @@ overrides: esbuild: '>=0.28.1' js-yaml: ^4.3.0 minimatch@10>brace-expansion: ^5.0.7 + minimatch@3>brace-expansion: ^1.1.16 + postcss: ^8.5.18 importers: @@ -613,8 +615,8 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - brace-expansion@1.1.15: - resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==} + brace-expansion@1.1.16: + resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} brace-expansion@5.0.8: resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} @@ -897,8 +899,8 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -949,8 +951,8 @@ packages: pixi.js@8.19.0: resolution: {integrity: sha512-pq1O6emA/GFjjeF+8d3Pb5t7knD8FsnfWGqQcRjYjsqFZ7QdzG1XgjLDUu0DFJRbafjV5+g8iNLFBx0b9649lg==} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.24: + resolution: {integrity: sha512-8RyVklq0owXUTa4xlpzu4l9AaVKIdQvAcOHZWaMh98HgySsUtxRVf/chRe3dsSLqb6i40BzGRzEUddRaI+9TSw==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -1621,7 +1623,7 @@ snapshots: balanced-match@4.0.4: {} - brace-expansion@1.1.15: + brace-expansion@1.1.16: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 @@ -1908,11 +1910,11 @@ snapshots: minimatch@3.1.5: dependencies: - brace-expansion: 1.1.15 + brace-expansion: 1.1.16 ms@2.1.3: {} - nanoid@3.3.12: {} + nanoid@3.3.16: {} natural-compare@1.4.0: {} @@ -1964,9 +1966,9 @@ snapshots: parse-svg-path: 0.2.0 tiny-lru: 11.4.7 - postcss@8.5.15: + postcss@8.5.24: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -2135,7 +2137,7 @@ snapshots: esbuild: 0.28.1 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.24 rollup: 4.61.1 tinyglobby: 0.2.17 optionalDependencies: