fix: resolve security vulnerabilities in dependencies

.github/copilot-instructions.md

@@ -2,6 +2,15 @@
 
 This is a TypeScript-based Node.js project that packages Node.js applications into standalone executables. The project is maintained by the yao-pkg organization and is a fork of the original vercel/pkg project.
 
+## CRITICAL: Repository and PR Guidelines
+
+**IMPORTANT:** This repository is `yao-pkg/pkg`, a fork of the original `vercel/pkg` (which is ARCHIVED and read-only).
+
+- ✅ **ALWAYS create PRs against `yao-pkg/pkg`** (this fork)
+- ❌ **NEVER create PRs against `vercel/pkg`** (the upstream is archived and cannot accept PRs)
+- When using `gh pr create`, always specify the correct repository
+- The upstream `vercel/pkg` should be completely ignored for PR creation purposes
+
 ## Project Overview
 
 `pkg` is a command-line tool that:
@@ -55,19 +64,16 @@ npm run start
 **CRITICAL: Follow this workflow for ALL commits and pushes:**
 
 1. **Clean test artifacts**: Remove any test-generated output files (executables, binaries) before staging changes
-
    - Test artifacts typically include: `*.exe`, `*-linux`, `*-macos`, `*-win.exe` in test directories
    - Check staged files with `git status` and remove any test outputs
    - These files may remain if a test failed before cleanup
 
 2. **Verify no lint issues**:
-
    - ALWAYS run `npm run lint` before committing
    - Fix all linting errors with `npm run fix` or manually
    - NEVER commit or push with lint errors present
 
 3. **Request approval before commit/push**:
-
    - Show the user what files will be committed (`git status --short`)
    - Present a summary of changes made
    - Wait for explicit user approval before running `git commit` and `git push`

lib/detector.ts

@@ -80,7 +80,6 @@ function reconstructSpecifiers(
 }
 
 function reconstruct(node: babelTypes.Node) {
-  // @ts-expect-error Type mismatch due to @babel/types version in @types/babel__generator
   let v = generate(node, { comments: false }).code.replace(/\n/g, '');
   let v2;
 

lib/esm-transformer.ts

@@ -44,7 +44,6 @@ function hasImportMeta(code: string): boolean {
 
     let found = false;
 
-    // @ts-expect-error Type mismatch due to @babel/types version in @types/babel__traverse
     traverse(ast as t.File, {
       // Detect import.meta usage
       MetaProperty(path: NodePath<t.MetaProperty>) {
@@ -96,7 +95,6 @@ function detectESMFeatures(
     const topLevelAwait: UnsupportedFeature[] = [];
     const unsupportedFeatures: UnsupportedFeature[] = [];
 
-    // @ts-expect-error Type mismatch due to @babel/types version in @types/babel__traverse
     traverse(ast as t.File, {
       // Detect top-level await - can be handled with async IIFE wrapper
       AwaitExpression(path: NodePath<t.AwaitExpression>) {
@@ -291,7 +289,6 @@ export function transformESMtoCJS(
       const codeLines = code.split('\n');
       const importLineIndices = new Set<number>();
 
-      // @ts-expect-error Type mismatch due to @babel/types version
       traverse(ast as t.File, {
         ExportNamedDeclaration() {
           hasExports = true;

package.json

@@ -99,5 +99,14 @@
   "packageManager": "yarn@1.22.22",
   "engines": {
     "node": ">=18.0.0"
+  },
+  "resolutions": {
+    "lodash": "^4.17.23",
+    "@octokit/request-error": "^5.1.1",
+    "@octokit/plugin-paginate-rest": "^9.2.2",
+    "@octokit/request": "^8.4.1",
+    "js-yaml": "^4.1.1",
+    "brace-expansion": "^2.0.2",
+    "tmp": "^0.2.4"
   }
 }

test/test-79-npm/pg-query-stream/pg-query-stream@1.0.0.js

@@ -1,9 +1,10 @@
 'use strict';
 
 var QueryStream = require('pg-query-stream');
-var query = new QueryStream('SELECT * FROM generate_series(0, $1) num', [
-  1000000,
-]);
+var query = new QueryStream(
+  'SELECT * FROM generate_series(0, $1) num',
+  [1000000],
+);
 if (query.state || (query.cursor && query.cursor.state)) {
   console.log('ok');
 }

test/test.js

@@ -194,9 +194,7 @@ async function run() {
       await runTest(file);
       ok++;
       addLog(
-        pc.green(
-          `✔ ${file} ok - ${msToHumanDuration(Date.now() - startTest)}`,
-        ),
+        pc.green(`✔ ${file} ok - ${msToHumanDuration(Date.now() - startTest)}`),
       );
     } catch (error) {
       failed.push({