From 6c4a015296e6b77012e7d16cd503d924de27491e Mon Sep 17 00:00:00 2001 From: Takashi Matsuyama Date: Thu, 3 Sep 2026 19:55:53 +0900 Subject: [PATCH] fix(deps): clear the dev tree's open security alerts in the lockfile Eight Dependabot alerts were open against pnpm-lock.yaml, all of them in the dev dependency tree. Each package moves inside its existing range, so no manifest changes: fast-uri 3.1.2 -> 3.1.7 (#24 GHSA-fph4-wmhf-6fwf, #20 GHSA-7p8r-x3mc-p8w7, #11 GHSA-v2hh-gcrm-f6hx, #10 GHSA-4c8g-83qw-93j6) postcss 8.5.13 -> 8.5.27 (#19 GHSA-fxqj-rqcc-2cmp, #13 GHSA-r28c-9q8g-f849) brace-expansion 2.1.1 -> 2.1.4 (#12 GHSA-3jxr-9vmj-r5cp) brace-expansion 5.0.6 -> 5.0.9 (#9 GHSA-3jxr-9vmj-r5cp) nanoid 3.3.12 -> 3.3.18 comes along as postcss's own dependency. The published packages were never affected. Dependabot labels the four fast-uri alerts `runtime`, but its only path into the tree is packages/core's devDependencies (ajv / ajv-formats); the published @basou/core declares simple-git, ulid, yaml and zod alone. That is also why CI stayed green while eight alerts sat open: the audit job runs `pnpm audit --prod` by design, so a dev-only advisory never reaches it. Whether to widen that gate, and whether to enable Dependabot security updates (currently off, which is why none of these alerts opened a PR of its own), are separate calls left untouched here. One low advisory stays out of scope: esbuild 0.27.7 via tsup (GHSA-g7r4-m6w7-qqqr, a Windows dev-server file read) is patched in 0.28.1, which needs a tsup bump rather than a lockfile refresh. Co-Authored-By: Claude Opus 5 --- pnpm-lock.yaml | 54 +++++++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a34bf3b1..e4de65b3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -22,7 +22,7 @@ importers: version: 3.2.6(vitest@3.2.6(@types/node@25.9.2)(yaml@2.9.0)) tsup: specifier: ^8.3.0 - version: 8.5.1(postcss@8.5.13)(typescript@6.0.3)(yaml@2.9.0) + version: 8.5.1(postcss@8.5.27)(typescript@6.0.3)(yaml@2.9.0) typescript: specifier: ^6.0.3 version: 6.0.3 @@ -726,12 +726,12 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - brace-expansion@2.1.1: - resolution: {integrity: sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} bundle-require@5.1.0: resolution: {integrity: sha512-3WrrOuZiyaaZPWiEt4G3+IffISVC9HYlWueJEBWED4ZH4aIAC2PnkdnuRrR94M+w6yGWn4AglWtJtBI8YqvgoA==} @@ -826,8 +826,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.7: + resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} @@ -949,8 +949,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1008,8 +1008,8 @@ packages: yaml: optional: true - postcss@8.5.13: - resolution: {integrity: sha512-qif0+jGGZoLWdHey3UFHHWP0H7Gbmsk8T5VEqyYFbWqPr1XqvLGBbk/sl8V5exGmcYJklJOhOQq1pV9IcsiFag==} + postcss@8.5.27: + resolution: {integrity: sha512-79Iho8QeYyooJ8e9lCRyTVlyTAkS/kXBYKff6TMzS3kEWGQ8Ds5UEtXpGrSUDLUWok6QTvxeYy0GO8fopHnaSA==} engines: {node: ^10 || ^12 || >=14} readdirp@4.1.2: @@ -1680,7 +1680,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.7 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -1708,11 +1708,11 @@ snapshots: balanced-match@4.0.4: {} - brace-expansion@2.1.1: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.6: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -1837,7 +1837,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.2: {} + fast-uri@3.1.7: {} fdir@6.5.0(picomatch@4.0.4): optionalDependencies: @@ -1935,11 +1935,11 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.9 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.1 + brace-expansion: 2.1.4 minipass@7.1.3: {} @@ -1958,7 +1958,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.12: {} + nanoid@3.3.18: {} object-assign@4.1.1: {} @@ -1987,16 +1987,16 @@ snapshots: mlly: 1.8.2 pathe: 2.0.3 - postcss-load-config@6.0.1(postcss@8.5.13)(yaml@2.9.0): + postcss-load-config@6.0.1(postcss@8.5.27)(yaml@2.9.0): dependencies: lilconfig: 3.1.3 optionalDependencies: - postcss: 8.5.13 + postcss: 8.5.27 yaml: 2.9.0 - postcss@8.5.13: + postcss@8.5.27: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -2138,7 +2138,7 @@ snapshots: ts-interface-checker@0.1.13: {} - tsup@8.5.1(postcss@8.5.13)(typescript@6.0.3)(yaml@2.9.0): + tsup@8.5.1(postcss@8.5.27)(typescript@6.0.3)(yaml@2.9.0): dependencies: bundle-require: 5.1.0(esbuild@0.27.7) cac: 6.7.14 @@ -2149,7 +2149,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(postcss@8.5.13)(yaml@2.9.0) + postcss-load-config: 6.0.1(postcss@8.5.27)(yaml@2.9.0) resolve-from: 5.0.0 rollup: 4.60.2 source-map: 0.7.6 @@ -2158,7 +2158,7 @@ snapshots: tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: - postcss: 8.5.13 + postcss: 8.5.27 typescript: 6.0.3 transitivePeerDependencies: - jiti @@ -2200,7 +2200,7 @@ snapshots: esbuild: 0.25.12 fdir: 6.5.0(picomatch@4.0.4) picomatch: 4.0.4 - postcss: 8.5.13 + postcss: 8.5.27 rollup: 4.60.2 tinyglobby: 0.2.16 optionalDependencies: