diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b426767..af2bc5d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -82,8 +82,8 @@ catalogs: specifier: 4.23.1 version: 4.23.1 turbo: - specifier: 2.10.4 - version: 2.10.4 + specifier: 2.10.5 + version: 2.10.5 typedoc: specifier: 0.28.20 version: 0.28.20 @@ -106,6 +106,11 @@ catalogs: specifier: 4.4.3 version: 4.4.3 +overrides: + brace-expansion@>=5.0.0 <5.0.7: 5.0.7 + js-yaml@>=4.0.0 <4.3.0: 4.3.0 + js-yaml@>=3.0.0 <3.15.0: 3.15.0 + importers: .: @@ -133,7 +138,7 @@ importers: version: 1.72.0 turbo: specifier: 'catalog:' - version: 2.10.4 + version: 2.10.5 docs: dependencies: @@ -2027,33 +2032,33 @@ packages: '@standardserver/shared@0.2.1': resolution: {integrity: sha512-kcWt26yFpEeWwXsRNwsdldNGBG0QnImPu0gTKd0+LnmPfnmogbnodTp5AMgDVD+J1AxJEkSQpV2q2LCjx0yRSQ==} - '@turbo/darwin-64@2.10.4': - resolution: {integrity: sha512-m1MUEI4MJ69r5CwfMYxmHi0H0rrgiYCBOp0tgBZ9x/YVvOb5uu/lRIDyDwdtH054R2yWeQaIigUGu6aCX9f8cA==} + '@turbo/darwin-64@2.10.5': + resolution: {integrity: sha512-ENvPwy3x5yS7MwNYHeWjqOBXkwIMp39Pd+/zXC6PoiNzF8EIvvLZOZZ+ny6L9x4WgS5vxUii2LM5gM+zjPdnWw==} cpu: [x64] os: [darwin] - '@turbo/darwin-arm64@2.10.4': - resolution: {integrity: sha512-VQ1Yxs5zkPT+2z7t1P4mvn6JmcKLkOCAsPuK9XbOvuVj0DlTlETfIXNisX0771v/vTWHOQqiwoGi+TtAUq8efw==} + '@turbo/darwin-arm64@2.10.5': + resolution: {integrity: sha512-rqROo9zsF/P9RqsdtbLD1nFJicjSrYyvQ9kNJC38AbxA3pAs6VAlATvtvOFx7bqOv6vicf20SP9kF33avJjy2w==} cpu: [arm64] os: [darwin] - '@turbo/linux-64@2.10.4': - resolution: {integrity: sha512-IzV1QovmwX7mfGnVinmE++2IB8tbeo38weltiuH5zNqwCTBjLs/DytyRKx+bmnhHdXIq9SheR8p0Nip/LBUPHg==} + '@turbo/linux-64@2.10.5': + resolution: {integrity: sha512-RoSSiNFUxi27zLJuM9F6GyWWjHgLch9t6nwD6K0FkXRirZkTLlzIj6IhFnK8H9++nefLtdFqylE4vGjZAv6AAA==} cpu: [x64] os: [linux] - '@turbo/linux-arm64@2.10.4': - resolution: {integrity: sha512-rfujSQkP5aYiRn0PgTM7F00WkJCP/bKDVZbOx3WmrZwa/vHA0bplhCl328kpX7VI9HH2vI90ISGwuSVgJgoqTw==} + '@turbo/linux-arm64@2.10.5': + resolution: {integrity: sha512-4ZComcpzmHGmVynQqvvi+iZOSq/tBvY1SltXB8g4NZRsrA01W8E+yRL8RNM+PLoyWsrCnJa8xa+DkWkv+xg4iQ==} cpu: [arm64] os: [linux] - '@turbo/windows-64@2.10.4': - resolution: {integrity: sha512-NnspP7Wd5fa3Wwnqv9bKfhegqZzuHBgbPxdZU/idTLQcazx/vgKu95JlCx2YHY0hdvKCnPcARrDwM+KEUmaO7A==} + '@turbo/windows-64@2.10.5': + resolution: {integrity: sha512-eL2Iyj4DbMINq1Sr1w0iAi6nAiZOF16KSlRGwCJpVh+IWZeY33MAsLHVOBMj1xoFtncVJXclCVpTPL2nBoYkFg==} cpu: [x64] os: [win32] - '@turbo/windows-arm64@2.10.4': - resolution: {integrity: sha512-Iv02YgOpaEShc2OkG7mgCJ2pEw1RUKiKbs0h8W5wAf4jZ5vpmraTEjuGTgHRuOORQnC1GN3KHo5WB+hu1abRMA==} + '@turbo/windows-arm64@2.10.5': + resolution: {integrity: sha512-sog+wP+8YSJrdWZ/rUJg8xghVTrwoG+BrSlDQpnK5fzSgJHn1INRWXbVWRH0d3vX8dBI01E3yxXRre9Dn+OXQA==} cpu: [arm64] os: [win32] @@ -2344,8 +2349,8 @@ packages: birpc@4.0.0: resolution: {integrity: sha512-LShSxJP0KTmd101b6DRyGBj57LZxSDYWKitQNW/mi8GRMvZb078Uf9+pveax1DrVL89vm7mWe+TovdI/UDOuPw==} - brace-expansion@5.0.6: - resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==} + brace-expansion@5.0.7: + resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} engines: {node: 18 || 20 || >=22} braces@3.0.3: @@ -2880,12 +2885,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.14.2: - resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} + js-yaml@3.15.0: + resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} hasBin: true - js-yaml@4.2.0: - resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==} + js-yaml@4.3.0: + resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} hasBin: true jsesc@3.1.0: @@ -3704,8 +3709,8 @@ packages: engines: {node: '>=18.0.0'} hasBin: true - turbo@2.10.4: - resolution: {integrity: sha512-GQpduILaKjoaGljw097ScsSyKTtZSY7cZ3bJktzfTkPMyCf3ShKLuXK2IaOEN2Plziml+ArR7WJ1m+V4VbnaKQ==} + turbo@2.10.5: + resolution: {integrity: sha512-07Y/C7OUp23l4P92PJoYtFNbHjLhftrZH5Ce7dbczS4kX2Re+wtbXvZLoxn/pUtzgsQaRCBaRuZPJp4zmAn0WQ==} hasBin: true type-fest@5.7.0: @@ -4284,7 +4289,7 @@ snapshots: '@changesets/parse@0.4.3': dependencies: '@changesets/types': 6.1.0 - js-yaml: 4.2.0 + js-yaml: 4.3.0 '@changesets/pre@2.0.2': dependencies: @@ -5435,22 +5440,22 @@ snapshots: '@standardserver/shared@0.2.1': {} - '@turbo/darwin-64@2.10.4': + '@turbo/darwin-64@2.10.5': optional: true - '@turbo/darwin-arm64@2.10.4': + '@turbo/darwin-arm64@2.10.5': optional: true - '@turbo/linux-64@2.10.4': + '@turbo/linux-64@2.10.5': optional: true - '@turbo/linux-arm64@2.10.4': + '@turbo/linux-arm64@2.10.5': optional: true - '@turbo/windows-64@2.10.4': + '@turbo/windows-64@2.10.5': optional: true - '@turbo/windows-arm64@2.10.4': + '@turbo/windows-arm64@2.10.5': optional: true '@tybys/wasm-util@0.10.2': @@ -5762,7 +5767,7 @@ snapshots: birpc@4.0.0: {} - brace-expansion@5.0.6: + brace-expansion@5.0.7: dependencies: balanced-match: 4.0.4 @@ -5896,7 +5901,7 @@ snapshots: dependencies: env-paths: 2.2.1 import-fresh: 3.3.1 - js-yaml: 4.2.0 + js-yaml: 4.3.0 parse-json: 5.2.0 optionalDependencies: typescript: 6.0.3 @@ -6272,12 +6277,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.14.2: + js-yaml@3.15.0: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.2.0: + js-yaml@4.3.0: dependencies: argparse: 2.0.1 @@ -6499,7 +6504,7 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.6 + brace-expansion: 5.0.7 minisearch@7.2.0: {} @@ -6823,7 +6828,7 @@ snapshots: read-yaml-file@1.1.0: dependencies: graceful-fs: 4.2.11 - js-yaml: 3.14.2 + js-yaml: 3.15.0 pify: 4.0.1 strip-bom: 3.0.0 @@ -7128,14 +7133,14 @@ snapshots: optionalDependencies: fsevents: 2.3.3 - turbo@2.10.4: + turbo@2.10.5: optionalDependencies: - '@turbo/darwin-64': 2.10.4 - '@turbo/darwin-arm64': 2.10.4 - '@turbo/linux-64': 2.10.4 - '@turbo/linux-arm64': 2.10.4 - '@turbo/windows-64': 2.10.4 - '@turbo/windows-arm64': 2.10.4 + '@turbo/darwin-64': 2.10.5 + '@turbo/darwin-arm64': 2.10.5 + '@turbo/linux-64': 2.10.5 + '@turbo/linux-arm64': 2.10.5 + '@turbo/windows-64': 2.10.5 + '@turbo/windows-arm64': 2.10.5 type-fest@5.7.0: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 2e4a9b3..6359e4b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -36,7 +36,7 @@ catalog: publint: 0.3.21 tsdown: 0.22.3 tsx: 4.23.1 - turbo: 2.10.4 + turbo: 2.10.5 typedoc: 0.28.20 typedoc-plugin-markdown: 4.12.0 typescript: 6.0.3 @@ -83,6 +83,14 @@ minimumReleaseAgeExclude: - "@unthrown/vitest" - "@btravstack/theme" +overrides: + # Security patches for high-severity CVEs in transitive dev/tool dependencies. + # brace-expansion: DoS via exponential-time expansion (GHSA-3jxr-9vmj-r5cp) + "brace-expansion@>=5.0.0 <5.0.7": "5.0.7" + # js-yaml: YAML merge-key quadratic CPU consumption (GHSA-52cp-r559-cp3m) + "js-yaml@>=4.0.0 <4.3.0": "4.3.0" + "js-yaml@>=3.0.0 <3.15.0": "3.15.0" + auditConfig: ignoreGhsas: # vite `server.fs.deny` bypass on Windows alternate paths. Reaches us only