From 18a4acecabec3af39fa0f22ec08f86552fd3aaeb Mon Sep 17 00:00:00 2001 From: Austin Turner Date: Fri, 16 Oct 2026 08:10:34 -0500 Subject: [PATCH 1/3] chore(deps): override transitive pins to clear npm audit findings Add an `overrides` block to both package.json files for transitive dependencies whose parent asks for a vulnerable range even though a patched release exists. Root: `get-uri` (via release-it -> proxy-agent -> pac-proxy-agent) pins `basic-ftp` 5; override to 6.2.1+. Root audit is now clean. Docs: `docusaurus-plugin-llms` pins `minimatch` 9.0.3 and `yaml` 2.8.1 exactly (overridden to 9.0.7+ / 2.8.3+); `sockjs` gets `uuid` 11; `argparse` 2 drops the `sprintf-js` that js-yaml 3's CLI-only dependency pulled in; `postcss-selector-parser` 7.1.6+, `serialize-javascript` 7.0.5+ and `tinypool` 2.1.2+ replace the majors Docusaurus 3.10 still resolves. Docs audit goes from 52 findings to 29, all from the single `braces` advisory (GHSA-vfj7-8cjw-p6xm) that has no patched release. Verified: root typecheck/build/tests, release-it and get-uri still load, docs typecheck and production build. --- AGENTS.md | 13 ++ CHANGELOG.md | 14 ++ docs/package-lock.json | 297 ++++------------------------------------- docs/package.json | 13 ++ package-lock.json | 6 +- package.json | 5 + 6 files changed, 76 insertions(+), 272 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 73f8b16..b38c3b3 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -4,6 +4,19 @@ Use conventional commit style messages. +## Dependency overrides + +Both `package.json` files carry an `overrides` block whose only job is to clear `npm audit` findings +that an upstream pin holds open: a dependency asking for a vulnerable range when a patched release +already exists. Every entry is temporary. When upgrading dependencies, check whether each override +is still needed by removing it, reinstalling and re-running `npm audit`, and drop the ones upstream +has caught up on. + +Scope an override to its parent (`"sockjs": { "uuid": "^11.1.1" }`) when only that dependent should +move; a top-level key applies to every copy in the tree. A nested key only reaches direct children +reliably: `"gray-matter": { "argparse": ... }` did not apply to the `argparse` that js-yaml 3 asks +for two levels down, which is why that override is top-level. + ## Formatting **ALWAYS run `npm run format` after making any change.** This is not optional and applies to every diff --git a/CHANGELOG.md b/CHANGELOG.md index 7035da5..1499cbe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file. ## [Unreleased] +### Changed + +- **Cleared the `npm audit` findings that upstream pins were holding open.** Both `package.json` + files now carry an `overrides` block for transitive dependencies whose parent asks for a + vulnerable range even though a patched release exists. At the root, `get-uri` (reached through + release-it, `proxy-agent` and `pac-proxy-agent`) pins `basic-ftp` 5, so it is overridden to + 6.2.1+ and the root audit is clean. In the docs site, `docusaurus-plugin-llms` pins `minimatch` + and `yaml` exactly (overridden to 9.0.7+ and 2.8.3+), `sockjs` gets `uuid` 11, `argparse` 2 + replaces the js-yaml 3 CLI-only dependency that pulled in `sprintf-js`, and + `postcss-selector-parser` 7.1.6+, `serialize-javascript` 7.0.5+ and `tinypool` 2.1.2+ replace the + majors Docusaurus 3.10 still resolves. That takes the docs audit from 52 findings to 29, all of + which trace back to a single `braces` advisory that has no patched release yet. No changes to the + published library. + ## [8.1.3] - 2026-10-31 ### Security diff --git a/docs/package-lock.json b/docs/package-lock.json index 9be519a..c75baf3 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -2239,19 +2239,6 @@ "postcss-selector-parser": "^7.0.0" } }, - "node_modules/@csstools/postcss-cascade-layers/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/@csstools/postcss-color-function": { "version": "4.0.12", "resolved": "https://registry.npmjs.org/@csstools/postcss-color-function/-/postcss-color-function-4.0.12.tgz", @@ -2660,19 +2647,6 @@ "postcss-selector-parser": "^7.0.0" } }, - "node_modules/@csstools/postcss-is-pseudo-class/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/@csstools/postcss-light-dark-function": { "version": "2.0.11", "resolved": "https://registry.npmjs.org/@csstools/postcss-light-dark-function/-/postcss-light-dark-function-2.0.11.tgz", @@ -3107,19 +3081,6 @@ "postcss": "^8.4" } }, - "node_modules/@csstools/postcss-scope-pseudo-class/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/@csstools/postcss-sign-functions": { "version": "1.1.4", "resolved": "https://registry.npmjs.org/@csstools/postcss-sign-functions/-/postcss-sign-functions-1.1.4.tgz", @@ -8168,12 +8129,6 @@ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", "license": "MIT" }, - "node_modules/concat-map": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", - "license": "MIT" - }, "node_modules/config-chain": { "version": "1.1.13", "resolved": "https://registry.npmjs.org/config-chain/-/config-chain-1.1.13.tgz", @@ -8473,19 +8428,6 @@ "postcss": "^8.4" } }, - "node_modules/css-blank-pseudo/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/css-declaration-sorter": { "version": "7.4.0", "resolved": "https://registry.npmjs.org/css-declaration-sorter/-/css-declaration-sorter-7.4.0.tgz", @@ -8547,19 +8489,6 @@ "postcss-selector-parser": "^7.0.0" } }, - "node_modules/css-has-pseudo/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/css-loader": { "version": "6.11.0", "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-6.11.0.tgz", @@ -10317,15 +10246,6 @@ "node": ">=6.0" } }, - "node_modules/gray-matter/node_modules/argparse": { - "version": "1.0.10", - "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz", - "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==", - "license": "MIT", - "dependencies": { - "sprintf-js": "~1.0.2" - } - }, "node_modules/gray-matter/node_modules/js-yaml": { "version": "3.15.2", "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", @@ -14467,12 +14387,12 @@ "license": "ISC" }, "node_modules/minimatch": { - "version": "9.0.3", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.3.tgz", - "integrity": "sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==", + "version": "9.0.9", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", + "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", "license": "ISC", "dependencies": { - "brace-expansion": "^2.0.1" + "brace-expansion": "^2.0.2" }, "engines": { "node": ">=16 || 14 >=14.17" @@ -15325,19 +15245,6 @@ "postcss": "^8.4" } }, - "node_modules/postcss-attribute-case-insensitive/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-calc": { "version": "9.0.1", "resolved": "https://registry.npmjs.org/postcss-calc/-/postcss-calc-9.0.1.tgz", @@ -15569,19 +15476,6 @@ "postcss": "^8.4" } }, - "node_modules/postcss-custom-selectors/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-dir-pseudo-class": { "version": "9.0.1", "resolved": "https://registry.npmjs.org/postcss-dir-pseudo-class/-/postcss-dir-pseudo-class-9.0.1.tgz", @@ -15607,19 +15501,6 @@ "postcss": "^8.4" } }, - "node_modules/postcss-dir-pseudo-class/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-discard-comments": { "version": "6.0.2", "resolved": "https://registry.npmjs.org/postcss-discard-comments/-/postcss-discard-comments-6.0.2.tgz", @@ -15735,19 +15616,6 @@ "postcss": "^8.4" } }, - "node_modules/postcss-focus-visible/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-focus-within": { "version": "9.0.1", "resolved": "https://registry.npmjs.org/postcss-focus-within/-/postcss-focus-within-9.0.1.tgz", @@ -15773,19 +15641,6 @@ "postcss": "^8.4" } }, - "node_modules/postcss-focus-within/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-font-variant": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/postcss-font-variant/-/postcss-font-variant-5.0.0.tgz", @@ -16062,19 +15917,6 @@ "postcss": "^8.1.0" } }, - "node_modules/postcss-modules-local-by-default/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-modules-scope": { "version": "3.2.1", "resolved": "https://registry.npmjs.org/postcss-modules-scope/-/postcss-modules-scope-3.2.1.tgz", @@ -16090,19 +15932,6 @@ "postcss": "^8.1.0" } }, - "node_modules/postcss-modules-scope/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-modules-values": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz", @@ -16189,19 +16018,6 @@ "postcss-selector-parser": "^7.0.0" } }, - "node_modules/postcss-nesting/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-normalize-charset": { "version": "6.0.2", "resolved": "https://registry.npmjs.org/postcss-normalize-charset/-/postcss-normalize-charset-6.0.2.tgz", @@ -16552,19 +16368,6 @@ "postcss": "^8.4" } }, - "node_modules/postcss-pseudo-class-any-link/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-reduce-idents": { "version": "6.0.3", "resolved": "https://registry.npmjs.org/postcss-reduce-idents/-/postcss-reduce-idents-6.0.3.tgz", @@ -16645,7 +16448,7 @@ "postcss": "^8.4" } }, - "node_modules/postcss-selector-not/node_modules/postcss-selector-parser": { + "node_modules/postcss-selector-parser": { "version": "7.1.6", "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", @@ -16658,19 +16461,6 @@ "node": ">=4" } }, - "node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/postcss-sort-media-queries": { "version": "5.2.0", "resolved": "https://registry.npmjs.org/postcss-sort-media-queries/-/postcss-sort-media-queries-5.2.0.tgz", @@ -16938,15 +16728,6 @@ "url": "https://github.com/sponsors/sindresorhus" } }, - "node_modules/randombytes": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz", - "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==", - "license": "MIT", - "dependencies": { - "safe-buffer": "^5.1.0" - } - }, "node_modules/range-parser": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.0.tgz", @@ -17932,12 +17713,12 @@ } }, "node_modules/serialize-javascript": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz", - "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==", + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.2.tgz", + "integrity": "sha512-GL2BWwVa6JydKO6l/ljVgjAZF4QJ3S7dWDWi53s5GZT8PJzD2fNxi67HANQGKAqPrwEpL5ba7gUBGi0Ls/sEoQ==", "license": "BSD-3-Clause", - "dependencies": { - "randombytes": "^2.1.0" + "engines": { + "node": ">=20.0.0" } }, "node_modules/serve-handler": { @@ -17955,28 +17736,6 @@ "range-parser": "1.2.0" } }, - "node_modules/serve-handler/node_modules/brace-expansion": { - "version": "1.1.21", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", - "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, - "node_modules/serve-handler/node_modules/minimatch": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", - "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", - "license": "ISC", - "dependencies": { - "brace-expansion": "^1.1.7" - }, - "engines": { - "node": "*" - } - }, "node_modules/serve-handler/node_modules/path-to-regexp": { "version": "3.3.0", "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-3.3.0.tgz", @@ -18415,12 +18174,6 @@ "wbuf": "^1.7.3" } }, - "node_modules/sprintf-js": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz", - "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==", - "license": "BSD-3-Clause" - }, "node_modules/srcset": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/srcset/-/srcset-4.0.0.tgz", @@ -18847,12 +18600,12 @@ "license": "MIT" }, "node_modules/tinypool": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-1.1.1.tgz", - "integrity": "sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==", + "version": "2.2.0", + "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-2.2.0.tgz", + "integrity": "sha512-jBrmx4lYmaC9k/mgPbylxs7kBUxHtD8256up+HjLaDFfXScKJQyil+SWXSvhAtT7XHo+yTVlpB81PGmHP8oLSQ==", "license": "MIT", "engines": { - "node": "^18.0.0 || >=20.0.0" + "node": "^20.0.0 || >=22.0.0" } }, "node_modules/to-regex-range": { @@ -19464,13 +19217,16 @@ } }, "node_modules/uuid": { - "version": "8.3.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", - "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", - "deprecated": "uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).", + "version": "11.1.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz", + "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], "license": "MIT", "bin": { - "uuid": "dist/bin/uuid" + "uuid": "dist/esm/bin/uuid" } }, "node_modules/value-equal": { @@ -20079,15 +19835,18 @@ "license": "ISC" }, "node_modules/yaml": { - "version": "2.8.1", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.1.tgz", - "integrity": "sha512-lcYcMxX2PO9XMGvAJkJ3OsNMw+/7FKes7/hgerGUYWIoWu5j/+YQqcZr5JnPZWzOsEBgMbSbiSTn/dv/69Mkpw==", + "version": "2.9.1", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", + "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", "license": "ISC", "bin": { "yaml": "bin.mjs" }, "engines": { "node": ">= 14.6" + }, + "funding": { + "url": "https://github.com/sponsors/eemeli" } }, "node_modules/yocto-queue": { diff --git a/docs/package.json b/docs/package.json index 4b237ba..bcccc5f 100644 --- a/docs/package.json +++ b/docs/package.json @@ -34,6 +34,19 @@ "@types/react": "^19.3.0", "typescript": "^7.0.2" }, + "overrides": { + "docusaurus-plugin-llms": { + "minimatch": "^9.0.7", + "yaml": "^2.8.3" + }, + "sockjs": { + "uuid": "^11.1.1" + }, + "argparse": "^2.0.1", + "postcss-selector-parser": "^7.1.6", + "serialize-javascript": "^7.0.5", + "tinypool": "^2.1.2" + }, "browserslist": { "production": [ ">0.5%", diff --git a/package-lock.json b/package-lock.json index 5894bde..9bfc1e4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2673,9 +2673,9 @@ } }, "node_modules/basic-ftp": { - "version": "5.3.1", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.1.tgz", - "integrity": "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==", + "version": "6.2.3", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-6.2.3.tgz", + "integrity": "sha512-T7GYtQ2eKJUN5YORG7A8u2WfB9JMN0a4/wl3MI64qq2qTRfa3FXzoNq0DDojZDkDyStcL+TkfKsz4JHEZx5kGQ==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 3c7f68b..9255567 100644 --- a/package.json +++ b/package.json @@ -72,6 +72,11 @@ "typescript": "^7.0.2", "vitest": "^5.0.3" }, + "overrides": { + "get-uri": { + "basic-ftp": "^6.2.1" + } + }, "keywords": [ "soql", "salesforce", From 82a211b3e358bfb008b666795246c9e134a84fc8 Mon Sep 17 00:00:00 2001 From: Austin Turner Date: Fri, 16 Oct 2026 08:26:42 -0500 Subject: [PATCH 2/3] fix(deps): key overrides on the requested range so they stop at their dependents A parent-scoped override ("docusaurus-plugin-llms": { "minimatch": ... }) leaked past its parent: once the overridden copy was hoisted, npm deduped serve-handler's minimatch@3.1.5 edge onto minimatch 9.0.9 and dropped the nested copy from the lockfile. serve-handler calls require('minimatch') as a function, which minimatch 9's CJS entry is not, so `docusaurus serve` would have thrown on its rewrite path. Keying each rule on the range the dependent asks for ("minimatch@9", "yaml@2", "uuid@8", "basic-ftp@5") only matches edges requesting that range, so serve-handler keeps its own 3.1.5 subtree. Audit results are unchanged (root 0, docs 29 from the braces advisory). Verified with a clean `npm ci` from the lockfile, the docs production build and a `docusaurus serve` smoke test. AGENTS.md guidance corrected to match. --- AGENTS.md | 13 +++++++++---- CHANGELOG.md | 7 ++++--- docs/package-lock.json | 28 ++++++++++++++++++++++++++++ docs/package.json | 10 +++------- package.json | 4 +--- 5 files changed, 45 insertions(+), 17 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index b38c3b3..a8b3edc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -12,10 +12,15 @@ already exists. Every entry is temporary. When upgrading dependencies, check whe is still needed by removing it, reinstalling and re-running `npm audit`, and drop the ones upstream has caught up on. -Scope an override to its parent (`"sockjs": { "uuid": "^11.1.1" }`) when only that dependent should -move; a top-level key applies to every copy in the tree. A nested key only reaches direct children -reliably: `"gray-matter": { "argparse": ... }` did not apply to the `argparse` that js-yaml 3 asks -for two levels down, which is why that override is top-level. +Key each override on the range the dependent asks for (`"uuid@8": "^11.1.1"`) rather than nesting +it under a parent (`"sockjs": { "uuid": ... }`). A keyed rule only applies to edges whose requested +range intersects the key, so every other dependent keeps the version it asked for. Nesting under a +parent looks tighter but is not: once the overridden copy is hoisted, npm dedupes other dependents +onto it too, which is how `"docusaurus-plugin-llms": { "minimatch": "^9.0.7" }` replaced +serve-handler's own `minimatch@3.1.5` with 9.0.9 and left `docusaurus serve` calling an export that +is no longer a function. A bare key (`"argparse": "^2.0.1"`) applies to every request of that +package, which is fine when every dependent accepts the new range. After changing an override, check +`npm ls ` for the dependents that should not have moved. ## Formatting diff --git a/CHANGELOG.md b/CHANGELOG.md index 1499cbe..79914b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,9 +14,10 @@ All notable changes to this project will be documented in this file. and `yaml` exactly (overridden to 9.0.7+ and 2.8.3+), `sockjs` gets `uuid` 11, `argparse` 2 replaces the js-yaml 3 CLI-only dependency that pulled in `sprintf-js`, and `postcss-selector-parser` 7.1.6+, `serialize-javascript` 7.0.5+ and `tinypool` 2.1.2+ replace the - majors Docusaurus 3.10 still resolves. That takes the docs audit from 52 findings to 29, all of - which trace back to a single `braces` advisory that has no patched release yet. No changes to the - published library. + majors Docusaurus 3.10 still resolves. Each override is keyed on the range the dependent asks for + (`"minimatch@9": "^9.0.7"`) so it stops at that dependent, and serve-handler keeps its own + `minimatch` 3.1.5. That takes the docs audit from 52 findings to 29, all of which trace back to a + single `braces` advisory that has no patched release yet. No changes to the published library. ## [8.1.3] - 2026-10-31 diff --git a/docs/package-lock.json b/docs/package-lock.json index c75baf3..c202915 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -8129,6 +8129,12 @@ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==", "license": "MIT" }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", + "license": "MIT" + }, "node_modules/config-chain": { "version": "1.1.13", "resolved": "https://registry.npmjs.org/config-chain/-/config-chain-1.1.13.tgz", @@ -17736,6 +17742,28 @@ "range-parser": "1.2.0" } }, + "node_modules/serve-handler/node_modules/brace-expansion": { + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, + "node_modules/serve-handler/node_modules/minimatch": { + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", + "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", + "license": "ISC", + "dependencies": { + "brace-expansion": "^1.1.7" + }, + "engines": { + "node": "*" + } + }, "node_modules/serve-handler/node_modules/path-to-regexp": { "version": "3.3.0", "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-3.3.0.tgz", diff --git a/docs/package.json b/docs/package.json index bcccc5f..7d18413 100644 --- a/docs/package.json +++ b/docs/package.json @@ -35,13 +35,9 @@ "typescript": "^7.0.2" }, "overrides": { - "docusaurus-plugin-llms": { - "minimatch": "^9.0.7", - "yaml": "^2.8.3" - }, - "sockjs": { - "uuid": "^11.1.1" - }, + "minimatch@9": "^9.0.7", + "yaml@2": "^2.8.3", + "uuid@8": "^11.1.1", "argparse": "^2.0.1", "postcss-selector-parser": "^7.1.6", "serialize-javascript": "^7.0.5", diff --git a/package.json b/package.json index 9255567..d363231 100644 --- a/package.json +++ b/package.json @@ -73,9 +73,7 @@ "vitest": "^5.0.3" }, "overrides": { - "get-uri": { - "basic-ftp": "^6.2.1" - } + "basic-ftp@5": "^6.2.1" }, "keywords": [ "soql", From e450173d856a78327434adb5c18d91bb9541f247 Mon Sep 17 00:00:00 2001 From: Austin Turner Date: Sun, 1 Nov 2026 08:34:39 -0700 Subject: [PATCH 3/3] chore(deps): clear new undici, minimatch and serialize-javascript advisories Root: npm audit fix moves release-it's undici to 7.30.1 (GHSA-4w7w-5xrc-9h26, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, GHSA-9fm3-97px-rjf6, GHSA-xjj6-f33q-929c and others). Docs: raise the minimatch@9 override to ^11.0.1 (GHSA-g3hv-75wg-m249 has no 9.x fix; docusaurus-plugin-llms uses the named minimatch export, which 11 still provides) and serialize-javascript to ^7.1.3 (GHSA-m5mm-p8h7-m29v). In-range lockfile bumps clear joi, follow-redirects, qs, body-parser and fast-uri. serve-handler keeps minimatch 3.1.5, which has no patched release. Verified with clean npm ci in both projects, root audit 0, lint, typecheck, 2370 tests, docs production build and a docusaurus serve smoke test. --- CHANGELOG.md | 19 ++++++----- docs/package-lock.json | 75 ++++++++++++++++++++++++++---------------- docs/package.json | 4 +-- package-lock.json | 20 +++++------ 4 files changed, 70 insertions(+), 48 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 79914b1..1dc657c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,14 +10,17 @@ All notable changes to this project will be documented in this file. files now carry an `overrides` block for transitive dependencies whose parent asks for a vulnerable range even though a patched release exists. At the root, `get-uri` (reached through release-it, `proxy-agent` and `pac-proxy-agent`) pins `basic-ftp` 5, so it is overridden to - 6.2.1+ and the root audit is clean. In the docs site, `docusaurus-plugin-llms` pins `minimatch` - and `yaml` exactly (overridden to 9.0.7+ and 2.8.3+), `sockjs` gets `uuid` 11, `argparse` 2 - replaces the js-yaml 3 CLI-only dependency that pulled in `sprintf-js`, and - `postcss-selector-parser` 7.1.6+, `serialize-javascript` 7.0.5+ and `tinypool` 2.1.2+ replace the - majors Docusaurus 3.10 still resolves. Each override is keyed on the range the dependent asks for - (`"minimatch@9": "^9.0.7"`) so it stops at that dependent, and serve-handler keeps its own - `minimatch` 3.1.5. That takes the docs audit from 52 findings to 29, all of which trace back to a - single `braces` advisory that has no patched release yet. No changes to the published library. + 6.2.1+. The lockfile also moves release-it's `undici` to 7.30.1 for its batch of advisories, so + the root audit is clean. In the docs site, `docusaurus-plugin-llms` pins `minimatch` and `yaml` + exactly (overridden to 11.0.1+ and 2.8.3+), `sockjs` gets `uuid` 11, `argparse` 2 replaces the + js-yaml 3 CLI-only dependency that pulled in `sprintf-js`, and `postcss-selector-parser` 7.1.6+, + `serialize-javascript` 7.1.3+ and `tinypool` 2.1.2+ replace the majors Docusaurus 3.10 still + resolves. In-range lockfile bumps clear the `joi`, `follow-redirects`, `qs`, `body-parser` and + `fast-uri` advisories. Each override is keyed on the range the dependent asks for + (`"minimatch@9": "^11.0.1"`) so it stops at that dependent, and serve-handler keeps its own + `minimatch` 3.1.5. Two advisories have no patched release yet and remain: `minimatch` 3.1.5 in + serve-handler (only used by `docusaurus serve`) and a low-severity `deepmerge` advisory under + `@svgr/plugin-svgo`. No changes to the published library. ## [8.1.3] - 2026-10-31 diff --git a/docs/package-lock.json b/docs/package-lock.json index c202915..66dfcb7 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -4158,6 +4158,12 @@ "@hapi/hoek": "^9.0.0" } }, + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "license": "BlueOak-1.0.0" + }, "node_modules/@jest/schemas": { "version": "29.6.3", "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz", @@ -7411,9 +7417,9 @@ } }, "node_modules/body-parser": { - "version": "1.20.8", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.8.tgz", - "integrity": "sha512-JNcyFQ64OiijEkPzUBTCe+hyPXUD/3LEldGQ6iF5LR1w00mx9o7xtDWHXBY2iItjdCFGoilOLNQbH943ut7pHA==", + "version": "1.20.9", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.9.tgz", + "integrity": "sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw==", "license": "MIT", "dependencies": { "bytes": "~3.1.2", @@ -7497,12 +7503,24 @@ } }, "node_modules/brace-expansion": { - "version": "2.1.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", - "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "license": "MIT", "dependencies": { - "balanced-match": "^1.0.0" + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/brace-expansion/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" } }, "node_modules/braces": { @@ -9728,9 +9746,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.8", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz", - "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "funding": [ { "type": "github", @@ -9945,9 +9963,9 @@ } }, "node_modules/follow-redirects": { - "version": "1.16.1", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", - "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", + "version": "1.16.2", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz", + "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==", "funding": [ { "type": "individual", @@ -11372,9 +11390,9 @@ } }, "node_modules/joi": { - "version": "17.13.8", - "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.8.tgz", - "integrity": "sha512-iPKOGmiRw1jxf/JOPwxmCcUQAOdF359mdzYiP2DJ+TMX0YK2zjK3D+zYOaGjpumWxOFF/l2xVWjRVK5bGSLdEw==", + "version": "17.13.9", + "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.9.tgz", + "integrity": "sha512-llFCT2rVtfwgBCaIqxtjim+iHqrgss4ONiGSYiiGH9jnjWq90ppSRffqmqKvwpa8W+YfILyQV6XyGcegXX2T4g==", "license": "BSD-3-Clause", "dependencies": { "@hapi/hoek": "^9.3.0", @@ -14393,15 +14411,16 @@ "license": "ISC" }, "node_modules/minimatch": { - "version": "9.0.9", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz", - "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==", - "license": "ISC", + "version": "11.0.3", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.3.tgz", + "integrity": "sha512-iny/40PEGkNJQ5/Pv6z3nm6FbRAby32GeZRjCUJk2WnNDbgPSTcdI+DDvLqsgBdD4cD5sMtMheqPPnehCCa8Nw==", + "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^2.0.2" + "@isaacs/nonrecursive-glob-match": "^1.0.3", + "brace-expansion": "^5.0.12" }, "engines": { - "node": ">=16 || 14 >=14.17" + "node": "18 || 20 || >=22" }, "funding": { "url": "https://github.com/sponsors/isaacs" @@ -16687,9 +16706,9 @@ } }, "node_modules/qs": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", - "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "version": "6.16.2", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.2.tgz", + "integrity": "sha512-VYdnB5S7/0IeXzBacUtwNAaM6d7Y/PgYnNC7bJCI6meqA/OgnsQbZMtVW8Dt2D1PHgbHGtYmhSoEIgvt7xZ2ZA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1", @@ -17719,9 +17738,9 @@ } }, "node_modules/serialize-javascript": { - "version": "7.1.2", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.2.tgz", - "integrity": "sha512-GL2BWwVa6JydKO6l/ljVgjAZF4QJ3S7dWDWi53s5GZT8PJzD2fNxi67HANQGKAqPrwEpL5ba7gUBGi0Ls/sEoQ==", + "version": "7.1.4", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.4.tgz", + "integrity": "sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==", "license": "BSD-3-Clause", "engines": { "node": ">=20.0.0" diff --git a/docs/package.json b/docs/package.json index 7d18413..b219b92 100644 --- a/docs/package.json +++ b/docs/package.json @@ -35,12 +35,12 @@ "typescript": "^7.0.2" }, "overrides": { - "minimatch@9": "^9.0.7", + "minimatch@9": "^11.0.1", "yaml@2": "^2.8.3", "uuid@8": "^11.1.1", "argparse": "^2.0.1", "postcss-selector-parser": "^7.1.6", - "serialize-javascript": "^7.0.5", + "serialize-javascript": "^7.1.3", "tinypool": "^2.1.2" }, "browserslist": { diff --git a/package-lock.json b/package-lock.json index 9bfc1e4..3c9ce1e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3308,9 +3308,9 @@ } }, "node_modules/ip-address": { - "version": "10.7.3", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz", - "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==", + "version": "10.7.5", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.5.tgz", + "integrity": "sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==", "dev": true, "license": "MIT", "engines": { @@ -4395,9 +4395,9 @@ } }, "node_modules/release-it": { - "version": "21.1.1", - "resolved": "https://registry.npmjs.org/release-it/-/release-it-21.1.1.tgz", - "integrity": "sha512-jOhoWMK3hm5UAYfxREcLW1BRlNzMhKfjN8m4sxjnOOPXDWk6b//mZIk2ABv9Cno/eH1M911iyGaCMtapnwS7Ng==", + "version": "21.1.2", + "resolved": "https://registry.npmjs.org/release-it/-/release-it-21.1.2.tgz", + "integrity": "sha512-5jy1qepCnvifzMjMV+Vj0redgjsK8uQF5VeUwP7xVJAadhxLLWAtzju+CUyEUUd/7Ru95LR+uuiQmScgl3l8BA==", "dev": true, "funding": [ { @@ -4429,7 +4429,7 @@ "os-name": "7.0.1", "proxy-agent": "8.0.2", "tinyglobby": "0.2.17", - "undici": "7.29.1", + "undici": "7.30.1", "url-join": "5.0.0", "verkit": "0.5.0", "wildcard-match": "5.1.6" @@ -4803,9 +4803,9 @@ } }, "node_modules/undici": { - "version": "7.29.1", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", - "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", + "version": "7.30.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz", + "integrity": "sha512-03KrMbjIFDWQR5RNPrSw3bd1r12JpyFQl9/yxjUbJtqkjmllqC5lFjZh6ujeuJCKr8EOQvRW872Oy/az+nLYxg==", "dev": true, "license": "MIT", "engines": {