From 7de9eb682ff21688ac822ff9f7e3460ced31919f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 31 Mar 2026 20:06:54 +0000 Subject: [PATCH 1/3] Initial plan From 2a0d94c0689098ef1cb8cc75dcd365c9ce973a57 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 31 Mar 2026 20:57:17 +0000 Subject: [PATCH 2/3] fix: patch Dependabot alerts #4, #9, #12 by upgrading path-to-regexp, picomatch, and brace-expansion Agent-Logs-Url: https://github.com/stellar/x402-stellar/sessions/63da46bc-19cc-40f0-a6b1-d4222b0440b7 Co-authored-by: sagpatil <1414227+sagpatil@users.noreply.github.com> --- package.json | 10 ++++++- pnpm-lock.yaml | 72 ++++++++++++++++++++++++++++---------------------- 2 files changed, 49 insertions(+), 33 deletions(-) diff --git a/package.json b/package.json index 90359ac..edfe72f 100644 --- a/package.json +++ b/package.json @@ -18,7 +18,15 @@ "@creit.tech/stellar-wallets-kit@2.0.0": "patches/@creit.tech__stellar-wallets-kit@2.0.0.patch" }, "overrides": { - "flatted": "^3.4.2" + "flatted": "^3.4.2", + "path-to-regexp": "^8.4.0", + "anymatch>picomatch": "^2.3.2", + "fdir>picomatch": "^4.0.4", + "tinyglobby>picomatch": "^4.0.4", + "vite>picomatch": "^4.0.4", + "vitest>picomatch": "^4.0.4", + "brace-expansion@1": "^1.1.13", + "brace-expansion@5": "^5.0.5" } }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a2b9f02..8919422 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,14 @@ settings: overrides: flatted: ^3.4.2 + path-to-regexp: ^8.4.0 + anymatch>picomatch: ^2.3.2 + fdir>picomatch: ^4.0.4 + tinyglobby>picomatch: ^4.0.4 + vite>picomatch: ^4.0.4 + vitest>picomatch: ^4.0.4 + brace-expansion@1: ^1.1.13 + brace-expansion@5: ^5.0.5 patchedDependencies: '@creit.tech/stellar-wallets-kit@2.0.0': @@ -2405,11 +2413,11 @@ packages: borsh@2.0.0: resolution: {integrity: sha512-kc9+BgR3zz9+cjbwM8ODoUB4fs3X3I5A/HtX7LZKxCLaMrEeDFoBpnhZY//DTS1VZBSs6S5v46RZRbZjRFspEg==} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} + brace-expansion@1.1.13: + resolution: {integrity: sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==} - brace-expansion@5.0.4: - resolution: {integrity: sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==} + brace-expansion@5.0.5: + resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==} engines: {node: 18 || 20 || >=22} brorand@1.1.0: @@ -2938,7 +2946,7 @@ packages: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} engines: {node: '>=12.0.0'} peerDependencies: - picomatch: ^3 || ^4 + picomatch: ^4.0.4 peerDependenciesMeta: picomatch: optional: true @@ -3672,8 +3680,8 @@ packages: resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==} engines: {node: '>=8'} - path-to-regexp@8.3.0: - resolution: {integrity: sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==} + path-to-regexp@8.4.1: + resolution: {integrity: sha512-fvU78fIjZ+SBM9YwCknCvKOUKkLVqtWDVctl0s7xIqfmfb38t2TT4ZU2gHm+Z8xGwgW+QWEU3oQSAzIbo89Ggw==} pathe@2.0.3: resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==} @@ -3689,12 +3697,12 @@ packages: picocolors@1.1.1: resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==} - picomatch@2.3.1: - resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==} + picomatch@2.3.2: + resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==} engines: {node: '>=8.6'} - picomatch@4.0.3: - resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==} + picomatch@4.0.4: + resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==} engines: {node: '>=12'} pino-abstract-transport@2.0.0: @@ -7710,7 +7718,7 @@ snapshots: anymatch@3.1.3: dependencies: normalize-path: 3.0.0 - picomatch: 2.3.1 + picomatch: 2.3.2 apg-js@4.4.0: {} @@ -7826,12 +7834,12 @@ snapshots: borsh@2.0.0: {} - brace-expansion@1.1.12: + brace-expansion@1.1.13: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.4: + brace-expansion@5.0.5: dependencies: balanced-match: 4.0.4 @@ -8461,9 +8469,9 @@ snapshots: fastestsmallesttextencoderdecoder@1.0.22: {} - fdir@6.5.0(picomatch@4.0.3): + fdir@6.5.0(picomatch@4.0.4): optionalDependencies: - picomatch: 4.0.3 + picomatch: 4.0.4 feaxios@0.0.23: dependencies: @@ -8994,11 +9002,11 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.4 + brace-expansion: 5.0.5 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.12 + brace-expansion: 1.1.13 minimist@1.2.8: {} @@ -9197,7 +9205,7 @@ snapshots: path-key@3.1.1: {} - path-to-regexp@8.3.0: {} + path-to-regexp@8.4.1: {} pathe@2.0.3: {} @@ -9214,9 +9222,9 @@ snapshots: picocolors@1.1.1: {} - picomatch@2.3.1: {} + picomatch@2.3.2: {} - picomatch@4.0.3: {} + picomatch@4.0.4: {} pino-abstract-transport@2.0.0: dependencies: @@ -9518,7 +9526,7 @@ snapshots: depd: 2.0.0 is-promise: 4.0.0 parseurl: 1.3.3 - path-to-regexp: 8.3.0 + path-to-regexp: 8.4.1 transitivePeerDependencies: - supports-color @@ -9825,8 +9833,8 @@ snapshots: tinyglobby@0.2.15: dependencies: - fdir: 6.5.0(picomatch@4.0.3) - picomatch: 4.0.3 + fdir: 6.5.0(picomatch@4.0.4) + picomatch: 4.0.4 tinypool@1.1.1: {} @@ -10140,8 +10148,8 @@ snapshots: vite@6.4.1(@types/node@22.19.13)(jiti@2.6.1)(lightningcss@1.31.1)(tsx@4.21.0): dependencies: esbuild: 0.25.12 - fdir: 6.5.0(picomatch@4.0.3) - picomatch: 4.0.3 + fdir: 6.5.0(picomatch@4.0.4) + picomatch: 4.0.4 postcss: 8.5.6 rollup: 4.59.0 tinyglobby: 0.2.15 @@ -10155,8 +10163,8 @@ snapshots: vite@7.3.1(@types/node@22.19.13)(jiti@2.6.1)(lightningcss@1.31.1)(tsx@4.21.0): dependencies: esbuild: 0.27.3 - fdir: 6.5.0(picomatch@4.0.3) - picomatch: 4.0.3 + fdir: 6.5.0(picomatch@4.0.4) + picomatch: 4.0.4 postcss: 8.5.6 rollup: 4.59.0 tinyglobby: 0.2.15 @@ -10170,8 +10178,8 @@ snapshots: vite@7.3.1(@types/node@25.3.2)(jiti@2.6.1)(lightningcss@1.31.1)(tsx@4.21.0): dependencies: esbuild: 0.27.3 - fdir: 6.5.0(picomatch@4.0.3) - picomatch: 4.0.3 + fdir: 6.5.0(picomatch@4.0.4) + picomatch: 4.0.4 postcss: 8.5.6 rollup: 4.59.0 tinyglobby: 0.2.15 @@ -10197,7 +10205,7 @@ snapshots: expect-type: 1.3.0 magic-string: 0.30.21 pathe: 2.0.3 - picomatch: 4.0.3 + picomatch: 4.0.4 std-env: 3.10.0 tinybench: 2.9.0 tinyexec: 0.3.2 @@ -10240,7 +10248,7 @@ snapshots: expect-type: 1.3.0 magic-string: 0.30.21 pathe: 2.0.3 - picomatch: 4.0.3 + picomatch: 4.0.4 std-env: 3.10.0 tinybench: 2.9.0 tinyexec: 0.3.2 From 1af25203698da8a3b98dea6fd50591ad4124f7dc Mon Sep 17 00:00:00 2001 From: Marcelo Salloum Date: Tue, 31 Mar 2026 14:27:11 -0700 Subject: [PATCH 3/3] fix: patch CVE alerts via lockfile update instead of pnpm overrides MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All parent packages (router, anymatch, tinyglobby, minimatch) already use semver ranges (^) that allow the patched versions. A targeted pnpm update is sufficient to pin the fixes — no overrides needed. - path-to-regexp: 8.3.0 → 8.4.1 (GHSA-j3q9-mxjg-w52f, GHSA-27v5-c462-wpq7) - picomatch@2: 2.3.1 → 2.3.2 (GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p) - picomatch@4: 4.0.3 → 4.0.4 (same) - brace-expansion@1: 1.1.12 → 1.1.13 (GHSA-f886-m6hf-6m8v) - brace-expansion@5: 5.0.4 → 5.0.5 (same) --- package.json | 10 +--------- pnpm-lock.yaml | 10 +--------- 2 files changed, 2 insertions(+), 18 deletions(-) diff --git a/package.json b/package.json index edfe72f..90359ac 100644 --- a/package.json +++ b/package.json @@ -18,15 +18,7 @@ "@creit.tech/stellar-wallets-kit@2.0.0": "patches/@creit.tech__stellar-wallets-kit@2.0.0.patch" }, "overrides": { - "flatted": "^3.4.2", - "path-to-regexp": "^8.4.0", - "anymatch>picomatch": "^2.3.2", - "fdir>picomatch": "^4.0.4", - "tinyglobby>picomatch": "^4.0.4", - "vite>picomatch": "^4.0.4", - "vitest>picomatch": "^4.0.4", - "brace-expansion@1": "^1.1.13", - "brace-expansion@5": "^5.0.5" + "flatted": "^3.4.2" } }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8919422..117c694 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,14 +6,6 @@ settings: overrides: flatted: ^3.4.2 - path-to-regexp: ^8.4.0 - anymatch>picomatch: ^2.3.2 - fdir>picomatch: ^4.0.4 - tinyglobby>picomatch: ^4.0.4 - vite>picomatch: ^4.0.4 - vitest>picomatch: ^4.0.4 - brace-expansion@1: ^1.1.13 - brace-expansion@5: ^5.0.5 patchedDependencies: '@creit.tech/stellar-wallets-kit@2.0.0': @@ -2946,7 +2938,7 @@ packages: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} engines: {node: '>=12.0.0'} peerDependencies: - picomatch: ^4.0.4 + picomatch: ^3 || ^4 peerDependenciesMeta: picomatch: optional: true