Automated Dependency Updates Report

[github-actions]

🔄 Relatório de Atualização de Dependências

As seguintes dependências possuem versões mais recentes disponíveis:

📁 package.json

Pacote	Nova Versão
@vitest/coverage-v8	^4.1.4
@vitest/ui	^4.1.4
jest	^30.3.0
jsdom	^29.0.2
npm-check-updates	^20.0.1
turbo	^2.9.6
typescript	^6.0.2
vitest	^4.1.4
npm	11.12.1

📁 apps/dev/package.json

Pacote	Nova Versão
@astrojs/check	^0.9.8
astro	^6.1.5
typescript	^6.0.2

📁 apps/farmhand/package.json

Pacote	Nova Versão
ws	^8.20.0
@types/node	^25.6.0
@types/ws	^8.18.1
typescript	^6.0.2
vitest	^4.1.4

📁 apps/me/package.json

Pacote	Nova Versão
astro	^6.1.5
typescript	^6.0.2
@astrojs/check	^0.9.8

📁 packages/cli/package.json

Pacote	Nova Versão
chalk	^5.6.2
commander	^14.0.3
inquirer	^13.4.1

📁 packages/ds/package.json

Pacote	Nova Versão
storybook	^10.3.5
@storybook/html	^10.3.5
@storybook/html-vite	^10.3.5
@storybook/addon-essentials	^8.6.14
@storybook/addon-interactions	^8.6.14
@storybook/addon-links	^10.3.5
@storybook/addon-a11y	^10.3.5

📁 packages/health/package.json

Pacote	Nova Versão
isomorphic-git	^1.37.5

📁 packages/heartwood/package.json

Pacote	Nova Versão
@bytecodealliance/jco	^1.17.6

📁 packages/homestead/package.json

Pacote	Nova Versão
astro	^6.1.5

📁 packages/silo/package.json

Pacote	Nova Versão
@noble/ed25519	^3.1.0

📁 packages/sync-loro/package.json

Pacote	Nova Versão
loro-crdt	^1.11.0

📁 packages/tractor-ts/package.json

Pacote	Nova Versão
@noble/ed25519	^3.1.0

📁 packages/vtconfig/package.json

Pacote	Nova Versão
typescript	^6.0.2
vite	^8.0.8
vitest	^4.1.4

📁 packages/windmill/package.json

Pacote	Nova Versão
@noble/ed25519	^3.1.0
isomorphic-git	^1.37.5

📁 validations/sqlite-benchmark/package.json

Pacote	Nova Versão
@sqlite.org/sqlite-wasm	^3.51.2-build8
@types/node	^25.6.0
@types/sql.js	^1.4.11
typescript	^6.0.2

📁 validations/sqlite-benchmark/browser/package.json

Pacote	Nova Versão
@sqlite.org/sqlite-wasm	^3.51.2-build8
@playwright/test	^1.59.1
@types/node	^25.6.0
@types/sql.js	^1.4.11
typescript	~6.0.2
vite	^8.0.8

📁 validations/wasm-plugin/host/package.json

Pacote	Nova Versão
@bytecodealliance/jco	^1.17.6
@playwright/test	^1.59.1
serve	^14.2.6
typescript	^6.0.2
vite	^8.0.8

---

🤖 Nota: Relatório gerado automaticamente por npm run deps:check.
⚠️ Ação Executada: Os arquivos package.json foram modificados com as novas versões. As mudanças estão prontas para o PR.

---

Caution

Testes Falharam! Esta atualização de dependências quebrou funcionalidades existentes. Verifique os logs do CI.

[aretw0]

Update: opened incremental mitigation PR #7 (basic-ftp high advisory).

• Scope: minimal override (basic-ftp -> 5.2.2) + lockfile
• Goal: unblock high-severity audit failure without merging the full dependency batch
• Residual: moderate yaml chain remains (yaml-language-server via @astrojs/check) and will be handled in a controlled follow-up track

This keeps #6 as the single tracking hub for dependency convergence.

[aretw0]

Opened root-cause PR for the yaml tooling chain: https://github.com/aretw0/refarm/pull/8\n\nAudit status from this branch:\n- npm audit --omit=dev: 4 moderate, 0 high/critical\n- npm audit: 4 moderate, 0 high/critical\n\nThis follows PR #7 and keeps dependency convergence centralized in #6.

[aretw0]

Status update before merging PR #8:\n\n- PR #8: https://github.com/aretw0/refarm/pull/8\n- CI convergence patch is in place\n- Residual moderate YAML advisory remains (GHSA-48c2-rrv3-qjmp)\n- A dedicated follow-up issue is being created with owner and due date\n\nIssue #6 remains the umbrella tracker for dependency convergence.

[aretw0]

Status update (post-merge of #8):

• ✅ PR chore(deps): root-cause track for yaml tooling chain #8 merged into develop: root-cause track for yaml tooling chain
• ✅ basic-ftp high advisory mitigation is in develop
• ⚠️ Remaining security debt is now isolated to the moderate YAML tooling chain tracked in Resolve residual yaml advisory chain (GHSA-48c2-rrv3-qjmp) after PR #8 #9
• ⚠️ Dependency Updates workflow still fails at PR creation due to Actions permission policy

Keeping #6 as umbrella tracking for dependency automation/convergence history.

[aretw0]

Closing as cleanup: dependency convergence work is complete in merged PR #8; no further umbrella tracking needed.