From 4cd5ac1aafcd46378ac99e56710857d91edcda48 Mon Sep 17 00:00:00 2001 From: Dagger Date: Wed, 23 Sep 2026 23:45:45 +0000 Subject: [PATCH 1/3] chore(deps): bump joi 17.13.4 -> 17.13.8 Replaces the production-patches bump from the deleted dependabot branch (#6051): joi 17.13.5-17.13.8 carry the messages proto-injection guard (hapijs/joi#3151) and the isoDate timeshift padding fix (hapijs/joi#3143). Co-Authored-By: Claude Code --- pnpm-lock.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 66a3d299c7..839381c350 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -217,7 +217,7 @@ importers: version: 2.2.0(react@19.3.0) '@hookform/resolvers': specifier: ^5.9.1 - version: 5.9.1(@sinclair/typebox@0.34.52)(@standard-schema/spec@1.1.0)(ajv-errors@3.0.0(ajv@8.20.0))(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.15.1)(effect@3.22.2)(joi@17.13.4)(react-hook-form@7.88.0(react@19.3.0))(zod@4.6.5) + version: 5.9.1(@sinclair/typebox@0.34.52)(@standard-schema/spec@1.1.0)(ajv-errors@3.0.0(ajv@8.20.0))(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.15.1)(effect@3.22.2)(joi@17.13.8)(react-hook-form@7.88.0(react@19.3.0))(zod@4.6.5) '@iconify-json/lucide': specifier: ^1.2.134 version: 1.2.134 @@ -1464,8 +1464,8 @@ importers: specifier: ^8.3.0 version: 8.3.0 joi: - specifier: 17.13.4 - version: 17.13.4 + specifier: 17.13.8 + version: 17.13.8 jsonwebtoken: specifier: ^9.0.0 version: 9.0.3 @@ -11194,8 +11194,8 @@ packages: resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==} hasBin: true - joi@17.13.4: - resolution: {integrity: sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==} + joi@17.13.8: + resolution: {integrity: sha512-iPKOGmiRw1jxf/JOPwxmCcUQAOdF359mdzYiP2DJ+TMX0YK2zjK3D+zYOaGjpumWxOFF/l2xVWjRVK5bGSLdEw==} jose@4.15.9: resolution: {integrity: sha512-1vUQX+IdDMVPj4k8kOxgUqlcK518yluMuGZwqlr44FS1ppZB/5GWh4rZG89erpOBOJjU/OBsnCVFfapsRz6nEA==} @@ -17587,7 +17587,7 @@ snapshots: dependencies: hono: 4.13.8 - '@hookform/resolvers@5.9.1(@sinclair/typebox@0.34.52)(@standard-schema/spec@1.1.0)(ajv-errors@3.0.0(ajv@8.20.0))(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.15.1)(effect@3.22.2)(joi@17.13.4)(react-hook-form@7.88.0(react@19.3.0))(zod@4.6.5)': + '@hookform/resolvers@5.9.1(@sinclair/typebox@0.34.52)(@standard-schema/spec@1.1.0)(ajv-errors@3.0.0(ajv@8.20.0))(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(class-transformer@0.5.1)(class-validator@0.15.1)(effect@3.22.2)(joi@17.13.8)(react-hook-form@7.88.0(react@19.3.0))(zod@4.6.5)': dependencies: '@standard-schema/utils': 0.3.0 react-hook-form: 7.88.0(react@19.3.0) @@ -26321,7 +26321,7 @@ snapshots: jiti@2.7.0: {} - joi@17.13.4: + joi@17.13.8: dependencies: '@hapi/hoek': 9.3.0 '@hapi/topo': 5.1.0 From 5fb18bddbb992ebc5b96acf31119ccda5c1420da Mon Sep 17 00:00:00 2001 From: Dagger Date: Wed, 23 Sep 2026 23:56:07 +0000 Subject: [PATCH 2/3] fix(deps): bump joi override pin to 17.13.8 The pnpm-workspace overrides pin joi: 17.13.4 was superseding the manifest ^17.13.8 bump from the major-updates merge (#6053), making the new version dead-letter and breaking the frozen lockfile check. Co-Authored-By: Claude Code --- pnpm-lock.yaml | 2 +- pnpm-workspace.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 839381c350..1d41c881e9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -75,7 +75,7 @@ overrides: js-yaml: 4.3.2 markdown-it: 14.2.0 '@opentelemetry/core': 2.8.0 - joi: 17.13.4 + joi: 17.13.8 jsonwebtoken: ^9.0.0 jws: '>=4.0.1' kerberos: ^7.0.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index de1aeb8f3c..83874b674c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -316,7 +316,7 @@ overrides: js-yaml: 4.3.2 markdown-it: 14.2.0 '@opentelemetry/core': 2.8.0 - joi: 17.13.4 + joi: 17.13.8 jsonwebtoken: ^9.0.0 jws: '>=4.0.1' kerberos: ^7.0.0 From 37a07aea4afc01bd0dbf2ba179ef330ce12392e1 Mon Sep 17 00:00:00 2001 From: Dagger Date: Thu, 24 Sep 2026 00:11:18 +0000 Subject: [PATCH 3/3] fix(deps): keep joi@17.13.4 resolvable for transitive pins px-cli's install still resolves joi@17.13.4 (some tooling pins the exact patch). Re-add its package + snapshot entries alongside 17.13.8. Co-Authored-By: Claude Code --- pnpm-lock.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1d41c881e9..8ecf5685b6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11194,6 +11194,9 @@ packages: resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==} hasBin: true + joi@17.13.4: + resolution: {integrity: sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==} + joi@17.13.8: resolution: {integrity: sha512-iPKOGmiRw1jxf/JOPwxmCcUQAOdF359mdzYiP2DJ+TMX0YK2zjK3D+zYOaGjpumWxOFF/l2xVWjRVK5bGSLdEw==} @@ -26321,6 +26324,14 @@ snapshots: jiti@2.7.0: {} + joi@17.13.4: + dependencies: + '@hapi/hoek': 9.3.0 + '@hapi/topo': 5.1.0 + '@sideway/address': 4.1.5 + '@sideway/formula': 3.0.1 + '@sideway/pinpoint': 2.0.0 + joi@17.13.8: dependencies: '@hapi/hoek': 9.3.0