From 5a9c29655df4d3361a470134e814176c6563be06 Mon Sep 17 00:00:00 2001
From: furedea <132188853+furedea@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:07:32 +0900
Subject: [PATCH] fix(deps): override tinypool to 2.1.2

Patch GHSA-5gmw-xhrv-c9v3 and GHSA-85c8-ppgw-ccpr in tinypool, which
oxfmt 0.45.0 pulls in as a dev-only transitive dependency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 pnpm-lock.yaml      | 11 +++++++----
 pnpm-workspace.yaml |  3 +++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8e07972..0cfa99b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  tinypool: 2.1.2
+
 importers:
 
   .:
@@ -279,8 +282,8 @@ packages:
       oxlint-tsgolint:
         optional: true
 
-  tinypool@2.1.0:
-    resolution: {integrity: sha512-Pugqs6M0m7Lv1I7FtxN4aoyToKg1C4tu+/381vH35y8oENM/Ai7f7C4StcoK4/+BSw9ebcS8jRiVrORFKCALLw==}
+  tinypool@2.1.2:
+    resolution: {integrity: sha512-9YodfrxS9g9IbFr/KOjE5bAeJ0p61n3bW6mqvy0jtoeKd1kTW1Cxm0oulm6KX2lyM9Gl6WIe8nEbY7LWv5ZJww==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   typescript@6.0.3:
@@ -406,7 +409,7 @@ snapshots:
 
   oxfmt@0.45.0:
     dependencies:
-      tinypool: 2.1.0
+      tinypool: 2.1.2
     optionalDependencies:
       '@oxfmt/binding-android-arm-eabi': 0.45.0
       '@oxfmt/binding-android-arm64': 0.45.0
@@ -450,6 +453,6 @@ snapshots:
       '@oxlint/binding-win32-ia32-msvc': 1.60.0
       '@oxlint/binding-win32-x64-msvc': 1.60.0
 
-  tinypool@2.1.0: {}
+  tinypool@2.1.2: {}
 
   typescript@6.0.3: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index cdd1496..bca2261 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,6 +3,9 @@ packages:
 
 catalogs: {}
 
+overrides:
+  tinypool: "2.1.2"
+
 auditConfig:
   ignoreCves: []