Skip to content

fix(deps): resolve known dependency vulnerabilities - #17

Merged
furedea merged 1 commit into
mainfrom
fix/dependency-vulnerabilities
Oct 17, 2026
Merged

furedea merged 1 commit into
mainfrom
fix/dependency-vulnerabilities

Conversation

@furedea-agent

@furedea-agent furedea-agent Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

Summary

Resolve the osv-scanner advisories reported against pnpm-lock.yaml.

  • Lock-only updates: brace-expansion 5.0.12, smol-toml 1.9.1, source-map-js 1.2.2
  • Add oxfmt>tinypool: 2.1.2 override, since oxfmt 0.45.0 pins tinypool 2.1.0 exactly
  • Remaining without a published fix: braces 3.0.3 (GHSA-vfj7-8cjw-p6xm)

Verification

  • osv-scanner scan source -r .: only the no-fix braces advisory remains
  • pnpm run check (format, lint, typecheck, test, test:release, knip): pass
  • pnpm run build: pass

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@furedea
furedea merged commit b8b48b2 into main Oct 17, 2026
13 checks passed
@furedea
furedea deleted the fix/dependency-vulnerabilities branch October 17, 2026 08:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant