From 40919d50ae007e0e9cd5cbf610eee772860cd129 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 21:56:16 +0000 Subject: [PATCH 1/3] chore(deps-dev): Bump @cloudflare/workers-types Bumps [@cloudflare/workers-types](https://github.com/cloudflare/workerd) from 4.20260702.1 to 5.20260708.1. - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) --- updated-dependencies: - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260708.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- packages/web-og/package.json | 2 +- packages/web/package.json | 2 +- pnpm-lock.yaml | 56 ++++++++++++++++++------------------ 3 files changed, 30 insertions(+), 30 deletions(-) diff --git a/packages/web-og/package.json b/packages/web-og/package.json index 8a46222..8cf385a 100644 --- a/packages/web-og/package.json +++ b/packages/web-og/package.json @@ -17,7 +17,7 @@ }, "devDependencies": { "@cloudflare/vitest-pool-workers": "0.18.8", - "@cloudflare/workers-types": "^4.20260702.1", + "@cloudflare/workers-types": "^5.20260708.1", "typescript": "^6.0.3", "vitest": "^4.1.10", "wrangler": "^4.114.0" diff --git a/packages/web/package.json b/packages/web/package.json index 84b9822..17e0c45 100644 --- a/packages/web/package.json +++ b/packages/web/package.json @@ -20,7 +20,7 @@ }, "devDependencies": { "@axe-core/playwright": "^4.12.1", - "@cloudflare/workers-types": "^4.20260702.1", + "@cloudflare/workers-types": "^5.20260708.1", "@types/jsdom": "^28.0.3", "axe-core": "^4.12.1", "jsdom": "^29.1.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 36c0cfc..9d39479 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -52,7 +52,7 @@ importers: version: 26.1.2 tsup: specifier: ^8.3.5 - version: 8.5.1(postcss@8.5.25)(tsx@4.23.1)(typescript@6.0.3) + version: 8.5.1(postcss@8.5.26)(tsx@4.23.1)(typescript@6.0.3) tsx: specifier: ^4.23.1 version: 4.23.1 @@ -92,8 +92,8 @@ importers: specifier: ^4.12.1 version: 4.12.1(playwright-core@1.61.1) '@cloudflare/workers-types': - specifier: ^4.20260702.1 - version: 4.20260702.1 + specifier: ^5.20260708.1 + version: 5.20260708.1 '@types/jsdom': specifier: ^28.0.3 version: 28.0.3 @@ -120,7 +120,7 @@ importers: version: 4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1)) wrangler: specifier: ^4.114.0 - version: 4.114.0(@cloudflare/workers-types@4.20260702.1)(@types/node@26.1.2) + version: 4.114.0(@cloudflare/workers-types@5.20260708.1)(@types/node@26.1.2) packages/web-og: dependencies: @@ -136,10 +136,10 @@ importers: devDependencies: '@cloudflare/vitest-pool-workers': specifier: 0.18.8 - version: 0.18.8(@cloudflare/workers-types@4.20260702.1)(@types/node@26.1.2)(@vitest/runner@4.1.10)(@vitest/snapshot@4.1.10)(vitest@4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1))) + version: 0.18.8(@cloudflare/workers-types@5.20260708.1)(@types/node@26.1.2)(@vitest/runner@4.1.10)(@vitest/snapshot@4.1.10)(vitest@4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1))) '@cloudflare/workers-types': - specifier: ^4.20260702.1 - version: 4.20260702.1 + specifier: ^5.20260708.1 + version: 5.20260708.1 typescript: specifier: ^6.0.3 version: 6.0.3 @@ -148,7 +148,7 @@ importers: version: 4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1)) wrangler: specifier: ^4.114.0 - version: 4.114.0(@cloudflare/workers-types@4.20260702.1)(@types/node@26.1.2) + version: 4.114.0(@cloudflare/workers-types@5.20260708.1)(@types/node@26.1.2) packages: @@ -341,8 +341,8 @@ packages: cpu: [x64] os: [win32] - '@cloudflare/workers-types@4.20260702.1': - resolution: {integrity: sha512-mOhf5TUEB1m2vPrxtqoIGfz0fUC9xyxRDx5gWHy5s+OCo6dcV+g7wI1R7gYCMFohhqF/2y2xeKVwMwCJjfn/WA==} + '@cloudflare/workers-types@5.20260708.1': + resolution: {integrity: sha512-FSRyCsxALKmmNnk/2HMkTiX9Iz9yqTiTWX/BJZdffGznMSunXmQgb3mKy9wGBX2BCTLOuRYWL36uh7/3Gm05Eg==} '@cspotcode/source-map-support@0.8.1': resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==} @@ -1600,8 +1600,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1718,8 +1718,8 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.25: - resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==} + postcss@8.5.26: + resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==} engines: {node: ^10 || ^12 || >=14} prettier@2.8.8: @@ -2368,7 +2368,7 @@ snapshots: optionalDependencies: workerd: 1.20260722.1 - '@cloudflare/vitest-pool-workers@0.18.8(@cloudflare/workers-types@4.20260702.1)(@types/node@26.1.2)(@vitest/runner@4.1.10)(@vitest/snapshot@4.1.10)(vitest@4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1)))': + '@cloudflare/vitest-pool-workers@0.18.8(@cloudflare/workers-types@5.20260708.1)(@types/node@26.1.2)(@vitest/runner@4.1.10)(@vitest/snapshot@4.1.10)(vitest@4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1)))': dependencies: '@vitest/runner': 4.1.10 '@vitest/snapshot': 4.1.10 @@ -2376,7 +2376,7 @@ snapshots: esbuild: 0.28.1 miniflare: 4.20260722.0(@types/node@26.1.2) vitest: 4.1.10(@types/node@26.1.2)(jsdom@29.1.1)(vite@8.0.16(@types/node@26.1.2)(esbuild@0.28.1)(tsx@4.23.1)) - wrangler: 4.114.0(@cloudflare/workers-types@4.20260702.1)(@types/node@26.1.2) + wrangler: 4.114.0(@cloudflare/workers-types@5.20260708.1)(@types/node@26.1.2) zod: 3.25.76 transitivePeerDependencies: - '@cloudflare/workers-types' @@ -2399,7 +2399,7 @@ snapshots: '@cloudflare/workerd-windows-64@1.20260722.1': optional: true - '@cloudflare/workers-types@4.20260702.1': {} + '@cloudflare/workers-types@5.20260708.1': {} '@cspotcode/source-map-support@0.8.1': dependencies: @@ -3488,7 +3488,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.16: {} + nanoid@3.3.18: {} object-assign@4.1.1: {} @@ -3561,18 +3561,18 @@ snapshots: optionalDependencies: fsevents: 2.3.2 - postcss-load-config@6.0.1(postcss@8.5.25)(tsx@4.23.1): + postcss-load-config@6.0.1(postcss@8.5.26)(tsx@4.23.1): dependencies: lilconfig: 3.1.3 optionalDependencies: - postcss: 8.5.25 + postcss: 8.5.26 tsx: 4.23.1 postcss-value-parser@4.2.0: {} - postcss@8.5.25: + postcss@8.5.26: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -3823,7 +3823,7 @@ snapshots: tslib@2.8.1: optional: true - tsup@8.5.1(postcss@8.5.25)(tsx@4.23.1)(typescript@6.0.3): + tsup@8.5.1(postcss@8.5.26)(tsx@4.23.1)(typescript@6.0.3): dependencies: bundle-require: 5.1.0(esbuild@0.28.1) cac: 6.7.14 @@ -3834,7 +3834,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(postcss@8.5.25)(tsx@4.23.1) + postcss-load-config: 6.0.1(postcss@8.5.26)(tsx@4.23.1) resolve-from: 5.0.0 rollup: 4.60.3 source-map: 0.7.6 @@ -3843,7 +3843,7 @@ snapshots: tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: - postcss: 8.5.25 + postcss: 8.5.26 typescript: 6.0.3 transitivePeerDependencies: - jiti @@ -3884,7 +3884,7 @@ snapshots: dependencies: lightningcss: 1.33.0 picomatch: 4.0.5 - postcss: 8.5.25 + postcss: 8.5.26 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: @@ -3961,7 +3961,7 @@ snapshots: satori: 0.15.2 yoga-wasm-web: 0.3.3 - wrangler@4.114.0(@cloudflare/workers-types@4.20260702.1)(@types/node@26.1.2): + wrangler@4.114.0(@cloudflare/workers-types@5.20260708.1)(@types/node@26.1.2): dependencies: '@cloudflare/kv-asset-handler': 0.5.0 '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260722.1) @@ -3972,7 +3972,7 @@ snapshots: unenv: 2.0.0-rc.24 workerd: 1.20260722.1 optionalDependencies: - '@cloudflare/workers-types': 4.20260702.1 + '@cloudflare/workers-types': 5.20260708.1 fsevents: 2.3.3 transitivePeerDependencies: - '@types/node' From e89fe7ee1cef7b67c9ae78291ee7da4a24e248ed Mon Sep 17 00:00:00 2001 From: liveapp-bot Date: Fri, 7 Aug 2026 18:42:35 -0400 Subject: [PATCH 2/3] =?UTF-8?q?fix(deps):=20bump=20pinned=20undici?= =?UTF-8?q?=E2=86=927.29.0,=20js-yaml=E2=86=924.3.1=20(clear=202=20High=20?= =?UTF-8?q?CVEs)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same 2 pre-existing High CVEs as #137 (undici 7.28.0 GHSA-4cwx-7wf7-3272, js-yaml 4.3.0 GHSA-5p4m-2wfm-xmqj) in main's pinned deps — not introduced by the @cloudflare/workers-types 4→5 bump. Bumping the override floors clears them. Local gate green: osv + typecheck + build + test. --- package.json | 6 ++-- pnpm-lock.yaml | 93 ++++++++++++++++++++++++++++++++++++-------------- 2 files changed, 70 insertions(+), 29 deletions(-) diff --git a/package.json b/package.json index 53046f9..9ca48b9 100644 --- a/package.json +++ b/package.json @@ -31,12 +31,12 @@ "pnpm": { "overrides": { "form-data": ">=4.0.6", - "undici": ">=7.28.0", - "jsdom>undici": ">=7.28.0 <8", + "undici": ">=7.29.0", + "jsdom>undici": ">=7.29.0 <8", "ws": ">=8.21.0", "vite": ">=6.4.3", "read-yaml-file@1": "^2.1.0", - "js-yaml@4": "^4.3.0", + "js-yaml@4": "^4.3.1", "esbuild": ">=0.28.1", "sharp": ">=0.35.0" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 9d39479..8a15326 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,12 +6,12 @@ settings: overrides: form-data: '>=4.0.6' - undici: '>=7.28.0' - jsdom>undici: '>=7.28.0 <8' + undici: '>=7.29.0' + jsdom>undici: '>=7.29.0 <8' ws: '>=8.21.0' vite: '>=6.4.3' read-yaml-file@1: ^2.1.0 - js-yaml@4: ^4.3.0 + js-yaml@4: ^4.3.1 esbuild: '>=0.28.1' sharp: '>=0.35.0' @@ -52,7 +52,7 @@ importers: version: 26.1.2 tsup: specifier: ^8.3.5 - version: 8.5.1(postcss@8.5.26)(tsx@4.23.1)(typescript@6.0.3) + version: 8.5.1(tsx@4.23.1)(typescript@6.0.3) tsx: specifier: ^4.23.1 version: 4.23.1 @@ -198,24 +198,28 @@ packages: engines: {node: '>=14.21.3'} cpu: [arm64] os: [linux] + libc: [musl] '@biomejs/cli-linux-arm64@2.5.6': resolution: {integrity: sha512-6XsYwCFkp5sMxl85ffhgeGpGgs6A7dRYFnkceZ7WVxvycuTnGdD5xa534Z3xfrBQ0JCMK/mujT6ZNPJoghedwg==} engines: {node: '>=14.21.3'} cpu: [arm64] os: [linux] + libc: [glibc] '@biomejs/cli-linux-x64-musl@2.5.6': resolution: {integrity: sha512-2Vp13QdKysH3HIWLaYLhUUwbK+jbZonJD1K+Lr0d0RO4wH7mkYd43vJixEDm8cUWrowoRz4UUHF1nm9Ae7ym8A==} engines: {node: '>=14.21.3'} cpu: [x64] os: [linux] + libc: [musl] '@biomejs/cli-linux-x64@2.5.6': resolution: {integrity: sha512-Pop9VXCFUhFTMfFefZ39S+u2rOPyNp5iHlxbZRwXGACHLy2r0jjiRgJHmaEKJzL3SyxlVeGShXhvvElvWowonA==} engines: {node: '>=14.21.3'} cpu: [x64] os: [linux] + libc: [glibc] '@biomejs/cli-win32-arm64@2.5.6': resolution: {integrity: sha512-tDGshcm6BdkZOCGnTDX0Y8/U4IfBSlnUU7T56nNDuPEfed+aHg+u8G36NB43fJVl0Os6+QURXIE1yuD7AaEofA==} @@ -596,89 +600,105 @@ packages: resolution: {integrity: sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==} cpu: [arm64] os: [linux] + libc: [glibc] '@img/sharp-libvips-linux-arm@1.3.2': resolution: {integrity: sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==} cpu: [arm] os: [linux] + libc: [glibc] '@img/sharp-libvips-linux-ppc64@1.3.2': resolution: {integrity: sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==} cpu: [ppc64] os: [linux] + libc: [glibc] '@img/sharp-libvips-linux-riscv64@1.3.2': resolution: {integrity: sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==} cpu: [riscv64] os: [linux] + libc: [glibc] '@img/sharp-libvips-linux-s390x@1.3.2': resolution: {integrity: sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==} cpu: [s390x] os: [linux] + libc: [glibc] '@img/sharp-libvips-linux-x64@1.3.2': resolution: {integrity: sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==} cpu: [x64] os: [linux] + libc: [glibc] '@img/sharp-libvips-linuxmusl-arm64@1.3.2': resolution: {integrity: sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==} cpu: [arm64] os: [linux] + libc: [musl] '@img/sharp-libvips-linuxmusl-x64@1.3.2': resolution: {integrity: sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==} cpu: [x64] os: [linux] + libc: [musl] '@img/sharp-linux-arm64@0.35.3': resolution: {integrity: sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==} engines: {node: '>=20.9.0'} cpu: [arm64] os: [linux] + libc: [glibc] '@img/sharp-linux-arm@0.35.3': resolution: {integrity: sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==} engines: {node: '>=20.9.0'} cpu: [arm] os: [linux] + libc: [glibc] '@img/sharp-linux-ppc64@0.35.3': resolution: {integrity: sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==} engines: {node: '>=20.9.0'} cpu: [ppc64] os: [linux] + libc: [glibc] '@img/sharp-linux-riscv64@0.35.3': resolution: {integrity: sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==} engines: {node: '>=20.9.0'} cpu: [riscv64] os: [linux] + libc: [glibc] '@img/sharp-linux-s390x@0.35.3': resolution: {integrity: sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==} engines: {node: '>=20.9.0'} cpu: [s390x] os: [linux] + libc: [glibc] '@img/sharp-linux-x64@0.35.3': resolution: {integrity: sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==} engines: {node: '>=20.9.0'} cpu: [x64] os: [linux] + libc: [glibc] '@img/sharp-linuxmusl-arm64@0.35.3': resolution: {integrity: sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==} engines: {node: '>=20.9.0'} cpu: [arm64] os: [linux] + libc: [musl] '@img/sharp-linuxmusl-x64@0.35.3': resolution: {integrity: sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==} engines: {node: '>=20.9.0'} cpu: [x64] os: [linux] + libc: [musl] '@img/sharp-wasm32@0.35.3': resolution: {integrity: sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==} @@ -812,36 +832,42 @@ packages: engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] + libc: [glibc] '@rolldown/binding-linux-arm64-musl@1.0.3': resolution: {integrity: sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [arm64] os: [linux] + libc: [musl] '@rolldown/binding-linux-ppc64-gnu@1.0.3': resolution: {integrity: sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [ppc64] os: [linux] + libc: [glibc] '@rolldown/binding-linux-s390x-gnu@1.0.3': resolution: {integrity: sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [s390x] os: [linux] + libc: [glibc] '@rolldown/binding-linux-x64-gnu@1.0.3': resolution: {integrity: sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] + libc: [glibc] '@rolldown/binding-linux-x64-musl@1.0.3': resolution: {integrity: sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==} engines: {node: ^20.19.0 || >=22.12.0} cpu: [x64] os: [linux] + libc: [musl] '@rolldown/binding-openharmony-arm64@1.0.3': resolution: {integrity: sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==} @@ -903,66 +929,79 @@ packages: resolution: {integrity: sha512-DV6fJoxEYWJOvaZIsok7KrYl0tPvga5OZ2yvKHNNYyk/2roMLqQAbGhr78EQ5YhHpnhLKJD3S1WFusAkmUuV5g==} cpu: [arm] os: [linux] + libc: [glibc] '@rollup/rollup-linux-arm-musleabihf@4.60.3': resolution: {integrity: sha512-mQKoJAzvuOs6F+TZybQO4GOTSMUu7v0WdxEk24krQ/uUxXoPTtHjuaUuPmFhtBcM4K0ons8nrE3JyhTuCFtT/w==} cpu: [arm] os: [linux] + libc: [musl] '@rollup/rollup-linux-arm64-gnu@4.60.3': resolution: {integrity: sha512-Whjj2qoiJ6+OOJMGptTYazaJvjOJm+iKHpXQM1P3LzGjt7Ff++Tp7nH4N8J/BUA7R9IHfDyx4DJIflifwnbmIA==} cpu: [arm64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-arm64-musl@4.60.3': resolution: {integrity: sha512-4YTNHKqGng5+yiZt3mg77nmyuCfmNfX4fPmyUapBcIk+BdwSwmCWGXOUxhXbBEkFHtoN5boLj/5NON+u5QC9tg==} cpu: [arm64] os: [linux] + libc: [musl] '@rollup/rollup-linux-loong64-gnu@4.60.3': resolution: {integrity: sha512-SU3kNlhkpI4UqlUc2VXPGK9o886ZsSeGfMAX2ba2b8DKmMXq4AL7KUrkSWVbb7koVqx41Yczx6dx5PNargIrEA==} cpu: [loong64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-loong64-musl@4.60.3': resolution: {integrity: sha512-6lDLl5h4TXpB1mTf2rQWnAk/LcXrx9vBfu/DT5TIPhvMhRWaZ5MxkIc8u4lJAmBo6klTe1ywXIUHFjylW505sg==} cpu: [loong64] os: [linux] + libc: [musl] '@rollup/rollup-linux-ppc64-gnu@4.60.3': resolution: {integrity: sha512-BMo8bOw8evlup/8G+cj5xWtPyp93xPdyoSN16Zy90Q2QZ0ZYRhCt6ZJSwbrRzG9HApFabjwj2p25TUPDWrhzqQ==} cpu: [ppc64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-ppc64-musl@4.60.3': resolution: {integrity: sha512-E0L8X1dZN1/Rph+5VPF6Xj2G7JJvMACVXtamTJIDrVI44Y3K+G8gQaMEAavbqCGTa16InptiVrX6eM6pmJ+7qA==} cpu: [ppc64] os: [linux] + libc: [musl] '@rollup/rollup-linux-riscv64-gnu@4.60.3': resolution: {integrity: sha512-oZJ/WHaVfHUiRAtmTAeo3DcevNsVvH8mbvodjZy7D5QKvCefO371SiKRpxoDcCxB3PTRTLayWBkvmDQKTcX/sw==} cpu: [riscv64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-riscv64-musl@4.60.3': resolution: {integrity: sha512-Dhbyh7j9FybM3YaTgaHmVALwA8AkUwTPccyCQ79TG9AJUsMQqgN1DDEZNr4+QUfwiWvLDumW5vdwzoeUF+TNxQ==} cpu: [riscv64] os: [linux] + libc: [musl] '@rollup/rollup-linux-s390x-gnu@4.60.3': resolution: {integrity: sha512-cJd1X5XhHHlltkaypz1UcWLA8AcoIi1aWhsvaWDskD1oz2eKCypnqvTQ8ykMNI0RSmm7NkTdSqSSD7zM0xa6Ig==} cpu: [s390x] os: [linux] + libc: [glibc] '@rollup/rollup-linux-x64-gnu@4.60.3': resolution: {integrity: sha512-DAZDBHQfG2oQuhY7mc6I3/qB4LU2fQCjRvxbDwd/Jdvb9fypP4IJ4qmtu6lNjes6B531AI8cg1aKC2di97bUxA==} cpu: [x64] os: [linux] + libc: [glibc] '@rollup/rollup-linux-x64-musl@4.60.3': resolution: {integrity: sha512-cRxsE8c13mZOh3vP+wLDxpQBRrOHDIGOWyDL93Sy0Ga8y515fBcC2pjUfFwUe5T7tqvTvWbCpg1URM/AXdWIXA==} cpu: [x64] os: [linux] + libc: [musl] '@rollup/rollup-openbsd-x64@4.60.3': resolution: {integrity: sha512-QaWcIgRxqEdQdhJqW4DJctsH6HCmo5vHxY0krHSX4jMtOqfzC+dqDGuHM87bu4H8JBeibWx7jFz+h6/4C8wA5Q==} @@ -1387,8 +1426,8 @@ packages: resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==} engines: {node: '>=10'} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true jsdom@29.1.1: @@ -1448,24 +1487,28 @@ packages: engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] + libc: [glibc] lightningcss-linux-arm64-musl@1.33.0: resolution: {integrity: sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] + libc: [musl] lightningcss-linux-x64-gnu@1.33.0: resolution: {integrity: sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] + libc: [glibc] lightningcss-linux-x64-musl@1.33.0: resolution: {integrity: sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] + libc: [musl] lightningcss-win32-arm64-msvc@1.33.0: resolution: {integrity: sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==} @@ -1600,8 +1643,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.18: - resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} + nanoid@3.3.17: + resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1718,8 +1761,8 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.26: - resolution: {integrity: sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==} + postcss@8.5.25: + resolution: {integrity: sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==} engines: {node: ^10 || ^12 || >=14} prettier@2.8.8: @@ -1970,8 +2013,8 @@ packages: undici-types@8.3.0: resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} undici@8.9.0: @@ -2323,7 +2366,7 @@ snapshots: '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 '@changesets/pre@2.0.2': dependencies: @@ -3211,7 +3254,7 @@ snapshots: joycon@3.1.1: {} - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -3232,7 +3275,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.28.0 + undici: 7.29.0 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -3488,7 +3531,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.18: {} + nanoid@3.3.17: {} object-assign@4.1.1: {} @@ -3561,18 +3604,17 @@ snapshots: optionalDependencies: fsevents: 2.3.2 - postcss-load-config@6.0.1(postcss@8.5.26)(tsx@4.23.1): + postcss-load-config@6.0.1(tsx@4.23.1): dependencies: lilconfig: 3.1.3 optionalDependencies: - postcss: 8.5.26 tsx: 4.23.1 postcss-value-parser@4.2.0: {} - postcss@8.5.26: + postcss@8.5.25: dependencies: - nanoid: 3.3.18 + nanoid: 3.3.17 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -3593,7 +3635,7 @@ snapshots: read-yaml-file@2.1.0: dependencies: - js-yaml: 4.3.0 + js-yaml: 4.3.1 strip-bom: 4.0.0 readdirp@4.1.2: {} @@ -3823,7 +3865,7 @@ snapshots: tslib@2.8.1: optional: true - tsup@8.5.1(postcss@8.5.26)(tsx@4.23.1)(typescript@6.0.3): + tsup@8.5.1(tsx@4.23.1)(typescript@6.0.3): dependencies: bundle-require: 5.1.0(esbuild@0.28.1) cac: 6.7.14 @@ -3834,7 +3876,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(postcss@8.5.26)(tsx@4.23.1) + postcss-load-config: 6.0.1(tsx@4.23.1) resolve-from: 5.0.0 rollup: 4.60.3 source-map: 0.7.6 @@ -3843,7 +3885,6 @@ snapshots: tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: - postcss: 8.5.26 typescript: 6.0.3 transitivePeerDependencies: - jiti @@ -3865,7 +3906,7 @@ snapshots: undici-types@8.3.0: {} - undici@7.28.0: {} + undici@7.29.0: {} undici@8.9.0: {} @@ -3884,7 +3925,7 @@ snapshots: dependencies: lightningcss: 1.33.0 picomatch: 4.0.5 - postcss: 8.5.26 + postcss: 8.5.25 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: From 0ec52be37582139646cb6725ffc6f1dae01b57b2 Mon Sep 17 00:00:00 2001 From: liveapp-bot Date: Thu, 20 Aug 2026 16:43:46 +0100 Subject: [PATCH 3/3] fix(deps): raise nanoid override floor to 3.3.18 (GHSA-2v37-7h3g-55p8, High) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This branch already pinned undici>=7.29.0 and js-yaml>=4.3.1 to clear two High advisories. A third has landed since: GHSA-2v37-7h3g-55p8 (CVSS 8.2, High) affects nanoid < 3.3.18, and this lockfile resolved nanoid to 3.3.17. The osv gate on this PR last ran 2026-08-12, before that advisory published, so its green is stale — merging as-is would land a High on main and re-red the dependency gate for every open PR (issue #145). Verified against api.osv.dev: nanoid@3.3.17 -> 1 advisory, GHSA-2v37-7h3g-55p8 (HIGH) nanoid@3.3.18 -> 0 advisories undici@7.29.0 -> 0 advisories js-yaml@4.3.1 -> 0 advisories postcss@8.5.25 was already in the tree; the tsup peer line in the lockfile is resolution metadata, not a new dependency. Co-Authored-By: Claude Opus 5 --- package.json | 1 + pnpm-lock.yaml | 19 +++++++++++-------- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/package.json b/package.json index 9ca48b9..bfe038d 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,7 @@ "vite": ">=6.4.3", "read-yaml-file@1": "^2.1.0", "js-yaml@4": "^4.3.1", + "nanoid@3": "^3.3.18", "esbuild": ">=0.28.1", "sharp": ">=0.35.0" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 8a15326..e20bed9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -12,6 +12,7 @@ overrides: vite: '>=6.4.3' read-yaml-file@1: ^2.1.0 js-yaml@4: ^4.3.1 + nanoid@3: ^3.3.18 esbuild: '>=0.28.1' sharp: '>=0.35.0' @@ -52,7 +53,7 @@ importers: version: 26.1.2 tsup: specifier: ^8.3.5 - version: 8.5.1(tsx@4.23.1)(typescript@6.0.3) + version: 8.5.1(postcss@8.5.25)(tsx@4.23.1)(typescript@6.0.3) tsx: specifier: ^4.23.1 version: 4.23.1 @@ -1643,8 +1644,8 @@ packages: mz@2.7.0: resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==} - nanoid@3.3.17: - resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -3531,7 +3532,7 @@ snapshots: object-assign: 4.1.1 thenify-all: 1.6.0 - nanoid@3.3.17: {} + nanoid@3.3.18: {} object-assign@4.1.1: {} @@ -3604,17 +3605,18 @@ snapshots: optionalDependencies: fsevents: 2.3.2 - postcss-load-config@6.0.1(tsx@4.23.1): + postcss-load-config@6.0.1(postcss@8.5.25)(tsx@4.23.1): dependencies: lilconfig: 3.1.3 optionalDependencies: + postcss: 8.5.25 tsx: 4.23.1 postcss-value-parser@4.2.0: {} postcss@8.5.25: dependencies: - nanoid: 3.3.17 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -3865,7 +3867,7 @@ snapshots: tslib@2.8.1: optional: true - tsup@8.5.1(tsx@4.23.1)(typescript@6.0.3): + tsup@8.5.1(postcss@8.5.25)(tsx@4.23.1)(typescript@6.0.3): dependencies: bundle-require: 5.1.0(esbuild@0.28.1) cac: 6.7.14 @@ -3876,7 +3878,7 @@ snapshots: fix-dts-default-cjs-exports: 1.0.1 joycon: 3.1.1 picocolors: 1.1.1 - postcss-load-config: 6.0.1(tsx@4.23.1) + postcss-load-config: 6.0.1(postcss@8.5.25)(tsx@4.23.1) resolve-from: 5.0.0 rollup: 4.60.3 source-map: 0.7.6 @@ -3885,6 +3887,7 @@ snapshots: tinyglobby: 0.2.16 tree-kill: 1.2.2 optionalDependencies: + postcss: 8.5.25 typescript: 6.0.3 transitivePeerDependencies: - jiti