[takashi-matsuyama]

Moves brace-expansion and fast-uri to patched versions. Lockfile only: every package moves inside its existing range, so no manifest changes.

Alert	Advisory	Package	Change
#33	GHSA-q2hr-2g5m-vwhr (medium)	brace-expansion	2.1.4 -> 2.1.7
#32	GHSA-q2hr-2g5m-vwhr (medium)	brace-expansion	5.0.9 -> 5.0.12
#34	GHSA-hrr3-gc8f-f4qj (medium)	fast-uri	3.1.7 -> 3.1.8

The same two bumps also close four high advisories that Dependabot had auto-dismissed rather than left open: GHSA-qhr7-859c-m2p7 (#31, #30) and GHSA-6j4f-fj2g-mc7p (#29, #28), both on brace-expansion.

That is the whole diff: 12 lines each way.

The published packages are not affected

Dependabot labels the fast-uri alert runtime, which is wrong here, as it was in #204. Its only path into the tree is packages/core's devDependencies (ajv / ajv-formats, used by the schema tests). pnpm why fast-uri -r --prod finds nothing. The published packages' production dependencies reach neither package:

$ npm view @basou/core@0.64.0 dependencies
{ zod: '^4.6.5', ulid: '^3.0.2', yaml: '^2.9.1', 'simple-git': '^3.36.0' }
$ npm view @basou/cli@0.64.0 dependencies
{ commander: '^14.0.3', '@basou/core': '0.64.0' }
$ npm view @basou/sdk@0.64.0 dependencies
{ '@basou/core': '0.64.0' }

What stays open

pnpm audit (dev included) still reports three advisories, all dev-only:

• the Vitest path traversal on vitest and @vitest/mocker (alerts feat(import): derive decision_recorded from AskUserQuestion tool uses #25, feat(import): add --force to re-import existing sessions #26 and feat(import): add codex adapter for native rollout logs #27). The fix needs vitest 4.1.11, a major upgrade from 3.2.6, so it is left to its own change;
• a low esbuild advisory on its development server.

The CI audit gate (pnpm audit --audit-level=moderate --prod) covers production dependencies only, by design. This PR leaves that scope unchanged.

Verification

Run on a copy of this branch:

• pnpm install --frozen-lockfile, pnpm -r build, pnpm typecheck, pnpm -r test:coverage, pnpm test:scripts, pnpm lint, pnpm lint:lang, pnpm lint:paths and pnpm audit --audit-level=moderate --prod all exit 0. Test counts: core 2205 passed and 1 skipped, sdk 65, cli 1379.
• Full pnpm audit: before, it reported ten advisories, seven of them on brace-expansion and fast-uri. After, the three listed above remain.

Checklist

• Branch is rebased on main.
• One commit, lockfile only.
• No behaviour change, so no new tests. The full suite passes.
• pnpm lint, pnpm typecheck, and pnpm test are all green locally.
• No CHANGELOG.md entry: dev-only dependencies with no user-visible change, as in fix(deps): clear the dev tree's open security alerts in the lockfile #204.
• CLI stderr is unaffected.

🤖 Generated with Claude Code