[takashi-matsuyama]

Clears all eight open Dependabot alerts on pnpm-lock.yaml. Lockfile only --
every package moves inside its existing range, so no manifest changes.

Alert	Advisory	Package	Change
#24	GHSA-fph4-wmhf-6fwf (high)	fast-uri	3.1.2 -> 3.1.7
#20	GHSA-7p8r-x3mc-p8w7 (high)	fast-uri	(same bump)
#11	GHSA-v2hh-gcrm-f6hx (high)	fast-uri	(same bump)
#10	GHSA-4c8g-83qw-93j6 (high)	fast-uri	(same bump)
#19	GHSA-fxqj-rqcc-2cmp (medium)	postcss	8.5.13 -> 8.5.27
#13	GHSA-r28c-9q8g-f849 (high)	postcss	(same bump)
#12	GHSA-3jxr-9vmj-r5cp (high)	brace-expansion	2.1.1 -> 2.1.4
#9	GHSA-3jxr-9vmj-r5cp (high)	brace-expansion	5.0.6 -> 5.0.9

nanoid 3.3.12 -> 3.3.18 comes along as postcss's own dependency. That is the
whole diff: 27 lines each way.

The published packages were never affected

Dependabot labels the four fast-uri alerts runtime, which is wrong here. Its
only path into the tree is packages/core's devDependencies (ajv /
ajv-formats, used by the schema tests). The published package declares four
production dependencies and none of them reach fast-uri:

$ npm view @basou/core@0.38.0 dependencies
{ "simple-git": "^3.36.0", "ulid": "^3.0.2", "yaml": "^2.9.0", "zod": "^4.4.3" }

postcss and brace-expansion are labelled development by Dependabot itself.

Why CI stayed green while eight alerts sat open

The audit job runs pnpm audit --audit-level=moderate --prod. Scoping it to
production dependencies is deliberate, and it means a dev-only advisory never
reaches that gate. Nothing here changes that scope.

Separately, Dependabot security updates are disabled for this repository
(automated-security-fixes reports enabled: false), which is why none of
these eight alerts opened a PR of its own -- dependabot.yml only configures
weekly version updates. Both of those are policy calls and are left alone in
this PR.

Verification

Run locally on this branch:

• pnpm install --frozen-lockfile -- clean
• pnpm typecheck -- 3/3 packages
• pnpm build -- 3/3 packages
• pnpm lint -- exit 0 (7 warnings / 1 info, all pre-existing on main)
• pnpm test -- 2544 passed, 1 skipped (core 1503, cli 1023, sdk 18)
• pnpm audit --audit-level=moderate --prod -- no known vulnerabilities
• pnpm audit --audit-level=low -- one remaining, out of scope below

Out of scope

esbuild 0.27.7 reaches the tree through tsup and carries a low advisory
(GHSA-g7r4-m6w7-qqqr, arbitrary file read via the dev server on Windows),
patched in 0.28.1. That is outside tsup's accepted range, so it needs a tsup
bump rather than a lockfile refresh, and it sits below the audit job's
moderate threshold. It has no Dependabot alert open.

🤖 Generated with Claude Code