diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 74a4241f9..0a231da48 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -54,9 +54,10 @@ overrides: postcss@<8.5.23: ^8.5.23 vite@>=7.0.0 <7.3.5: ~7.3.5 esbuild@>=0.27.3 <0.28.1: ^0.28.1 - js-yaml@<3.15.0: 3.15.0 - js-yaml@>=4.0.0 <5: 4.2.0 - fast-uri@<3.1.3: 3.1.3 + js-yaml@<3.15.1: 3.15.1 + js-yaml@>=4.0.0 <5: 4.3.1 + fast-uri@<3.1.5: 3.1.5 + brace-expansion@<5.0.7: ^5.0.7 importers: @@ -72,8 +73,8 @@ importers: specifier: ^22.20.1 version: 22.20.1 js-yaml: - specifier: 4.2.0 - version: 4.2.0 + specifier: 4.3.1 + version: 4.3.1 rimraf: specifier: ^6.1.3 version: 6.1.3 @@ -1935,9 +1936,9 @@ packages: resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} engines: {node: '>=18'} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.9: + resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -2336,8 +2337,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.3: - resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==} + fast-uri@3.1.5: + resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} fast-wrap-ansi@0.2.0: resolution: {integrity: sha512-rLV8JHxTyhVmFYhBJuMujcrHqOT2cnO5Zxj37qROj23CP39GXubJRBUFF0z8KFK77Uc0SukZUf7JZhsVEQ6n8w==} @@ -2568,12 +2569,12 @@ packages: js-tokens@9.0.1: resolution: {integrity: sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==} - js-yaml@3.15.0: - resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} + js-yaml@3.15.1: + resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} hasBin: true - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true json-schema-to-ts@3.1.1: @@ -3601,7 +3602,7 @@ snapshots: dependencies: '@jsdevtools/ono': 7.1.3 '@types/json-schema': 7.0.15 - js-yaml: 4.2.0 + js-yaml: 4.3.1 '@ark/schema@0.56.2': dependencies: @@ -3790,7 +3791,7 @@ snapshots: '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 - js-yaml: 4.2.0 + js-yaml: 4.3.1 '@changesets/pre@2.0.2': dependencies: @@ -4642,7 +4643,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.3 + fast-uri: 3.1.5 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4699,7 +4700,7 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@5.0.6: + brace-expansion@5.0.9: dependencies: balanced-match: 4.0.4 @@ -5010,7 +5011,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.3: {} + fast-uri@3.1.5: {} fast-wrap-ansi@0.2.0: dependencies: @@ -5226,12 +5227,12 @@ snapshots: js-tokens@9.0.1: {} - js-yaml@3.15.0: + js-yaml@3.15.1: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.2.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -5246,7 +5247,7 @@ snapshots: '@types/json-schema': 7.0.15 '@types/lodash': 4.17.21 is-glob: 4.0.3 - js-yaml: 4.2.0 + js-yaml: 4.3.1 lodash: 4.18.1 minimist: 1.2.8 prettier: 3.7.4 @@ -5361,7 +5362,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.9 minimist@1.2.8: {} @@ -5651,7 +5652,7 @@ snapshots: read-yaml-file@1.1.0: dependencies: graceful-fs: 4.2.11 - js-yaml: 3.15.0 + js-yaml: 3.15.1 pify: 4.0.1 strip-bom: 3.0.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e5371efcd..9118f735d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -68,22 +68,45 @@ overrides: # declares ^0.28. 'esbuild@>=0.27.3 <0.28.1': '^0.28.1' # #153 GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml merge-key DoS, 3.x line. - # Exact pin: 3.15.0 is the only patched 3.x release. Installed with the - # one-off `--config.minimum-release-age=0` bypass (published 2026-06-26, - # matures 2026-07-04) per SKILL.md, instead of a minimumReleaseAgeExclude - # entry. - 'js-yaml@<3.15.0': '3.15.0' + # #189 GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (HIGH) — quadratic-CPU DoS in + # `!!omap` duplicate-key detection; patched in 3.15.1. + # + # The `<3.15.0` selector had been overtaken by its own fix: the tree resolved + # exactly 3.15.0, so nothing matched and nothing lifted it to 3.15.1. Keep the + # ceiling AHEAD of the patched floor, not at it. Reached via `read-yaml-file`. + 'js-yaml@<3.15.1': '3.15.1' # #152 GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml merge-key DoS, 4.x line. - # Exact-pinned to the MATURED 4.2.0 (4.3.0 is still inside the cooldown), and - # kept exact because a past js-yaml upgrade broke changesets — bump this - # deliberately and re-verify `changeset status`/`version` when you do. - 'js-yaml@>=4.0.0 <5': '4.2.0' - # Not a Dependabot alert — cooldown-regression guard. Re-resolving the - # lockfile let minimumReleaseAge demote ajv's fast-uri to 3.1.2, un-fixing + # #155 GHSA-52cp-r559-cp3m / CVE-2026-59869 (HIGH, patched 4.3.0) and + # #188 GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (HIGH, patched 4.3.1). + # + # THIS ENTRY WAS ENFORCING THE VULNERABILITY. Unlike an overtaken selector, + # `>=4.0.0 <5` kept matching — so an exact pin written to FIX an advisory was + # holding the tree at 4.2.0 and blocking 4.3.1. That shape cannot self-heal + # and Dependabot cannot fix it either. + # + # The "a past js-yaml upgrade broke changesets" caution is DISCHARGED for this + # bump, checked rather than assumed: @changesets/parse declares + # `js-yaml: ^4.1.1`, which 4.3.1 satisfies; 4.2.0 and 4.3.1 have identical + # `dependencies` (argparse ^2.0.1) and `exports`, no `engines`, no `main`; + # 4.3.0/4.3.1 are security backports only, with no API removal on the 4.x + # line. The breaking churn — grouped constant exports, `MERGE_KEY` removal, + # mandatory `identify` — is all on 5.x, which the `<5` ceiling excludes. + # Verified with `changeset status` against @changesets/parse's own resolved + # copy. Kept exact so a 4.x regression cannot arrive silently. + 'js-yaml@>=4.0.0 <5': '4.3.1' + # Cooldown-regression guard AND two live advisories. Re-resolving the lockfile + # let minimumReleaseAge demote ajv's fast-uri to 3.1.2, un-fixing # GHSA-4c8g-83qw-93j6 / CVE-2026-13676 (host confusion via failed IDN - # canonicalization). Pin the patched release (published 2026-06-29, matures - # 2026-07-06); safe to relax to ^3.1.3 after that date. - 'fast-uri@<3.1.3': '3.1.3' + # canonicalization) — hence a pin rather than a floor. + # + # But 3.1.3 was itself overtaken: #158 (HIGH) needs 3.1.4 and #175 (HIGH) + # needs 3.1.5, so the exact pin was enforcing a vulnerable version — the same + # shape as the js-yaml 4.x entry above. Reached via ajv. + 'fast-uri@<3.1.5': '3.1.5' + + # #190 (HIGH) — brace-expansion. Transitive, reached through several dev + # toolchains; 5.0.7 is a patch on the line already resolved. + 'brace-expansion@<5.0.7': '^5.0.7' # Supply-chain hardening — see skills/stash-supply-chain-security/ # 7 days in minutes; mirrors the Dependabot cooldown so manual + automated