From d765f756881fee959be9fbc631d14588b4368923 Mon Sep 17 00:00:00 2001 From: htjulia Date: Tue, 6 Oct 2026 13:31:52 +0900 Subject: [PATCH] fix(deps): resolve five transitive security alerts in the lockfile Dependabot reports five open alerts on transitive build-time dependencies: brace-expansion 5.0.9 (#8, #9, #10, two high), via typedoc's minimatch; source-map-js 1.2.1 (#11, high), via the Vue compiler; and markdown-it 14.3.0 (#7), via typedoc. All are denial-of-service advisories triggered by crafted input. Every consumer's range already admits the patched version, so this is `pnpm update -r --depth Infinity` on the three packages and no override, the route #26 took for fast-uri. brace-expansion and source-map-js collapse onto versions the tree already had; markdown-it lands on 14.3.2, the latest patch. None of these reach a published package. typedoc's generated output is byte-identical to main's, so the markdown-it step changes no rendered docs. #12 (sprintf-js) has no patched release and stays open. Tags: #deps #security Co-Authored-By: htjulia --- pnpm-lock.yaml | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4d7695d..b628cb0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -604,10 +604,6 @@ packages: resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} - engines: {node: 20 || >=22} - chai@6.3.0: resolution: {integrity: sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==} engines: {node: '>=18'} @@ -798,8 +794,8 @@ packages: magic-string@1.4.2: resolution: {integrity: sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==} - markdown-it@14.3.0: - resolution: {integrity: sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==} + markdown-it@14.3.2: + resolution: {integrity: sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==} hasBin: true mdurl@2.1.0: @@ -908,10 +904,6 @@ packages: resolution: {integrity: sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==} engines: {node: '>=18'} - source-map-js@1.2.1: - resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==} - engines: {node: '>=0.10.0'} - source-map-js@1.2.2: resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==} engines: {node: '>=0.10.0'} @@ -1445,7 +1437,7 @@ snapshots: '@vue/shared': 3.5.43 entities: 7.0.1 estree-walker: 2.0.2 - source-map-js: 1.2.1 + source-map-js: 1.2.2 '@vue/compiler-dom@3.5.43': dependencies: @@ -1462,7 +1454,7 @@ snapshots: estree-walker: 2.0.2 magic-string: 0.30.21 postcss: 8.5.28 - source-map-js: 1.2.1 + source-map-js: 1.2.2 '@vue/compiler-ssr@3.5.43': dependencies: @@ -1529,10 +1521,6 @@ snapshots: dependencies: balanced-match: 4.0.4 - brace-expansion@5.0.9: - dependencies: - balanced-match: 4.0.4 - chai@6.3.0: {} convert-source-map@2.0.0: {} @@ -1669,7 +1657,7 @@ snapshots: dependencies: '@jridgewell/sourcemap-codec': 1.6.0 - markdown-it@14.3.0: + markdown-it@14.3.2: dependencies: argparse: 2.0.1 entities: 4.5.0 @@ -1686,7 +1674,7 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 mrmime@2.0.1: {} @@ -1774,8 +1762,6 @@ snapshots: mrmime: 2.0.1 totalist: 3.0.1 - source-map-js@1.2.1: {} - source-map-js@1.2.2: {} source-map@0.6.1: {} @@ -1809,7 +1795,7 @@ snapshots: dependencies: '@gerrit0/mini-shiki': 3.23.0 lunr: 2.3.9 - markdown-it: 14.3.0 + markdown-it: 14.3.2 minimatch: 10.2.6 typescript: 6.0.3 yaml: 2.9.0