From 888da45726a55d68861301dc0b802595db3adfdc Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 2 Oct 2026 18:10:18 +0000 Subject: [PATCH] fix(deps): update dependency undici@<6.23.0 to >=8.10.2 [security] Signed-off-by: Renovate Bot --- pnpm-lock.yaml | 4 +- pnpm-workspace.yaml | 602 ++++++++++++++++++++++---------------------- 2 files changed, 304 insertions(+), 302 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f1c962a3f..7dd09f3a0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -607,7 +607,7 @@ overrides: shell-quote@>=1.1.0 <=1.8.3: '>=1.10.0' svgo@>=4.0.0 <4.0.2: '>=4.0.2' tmp@<0.2.7: '>=0.2.7' - undici@<6.23.0: '>=8.10.0' + undici@<6.23.0: '>=8.10.2' undici@<6.24.0: '>=8.10.0' undici@>=7.0.0 <7.28.0: 8.10.0 undici@>=8.0.0 <8.5.0: 8.10.0 @@ -12256,7 +12256,7 @@ packages: '@vitest/ui': 4.1.10 happy-dom: '*' jsdom: '*' - vite: '>=8.2.0' + vite: '>=7.3.2' peerDependenciesMeta: '@edge-runtime/vm': optional: true diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 1e5569c8e..4c4c434be 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,311 +1,311 @@ packages: - - "packages/**" - - "!packages/eslint-config/__fixtures__/**" - # Scratch projects written by the eslint-config tests; each has a package.json and - # would otherwise be registered as a workspace project by an install during a test run. - - "!packages/eslint-config/tmp_fixtures/**" + - "packages/**" + - "!packages/eslint-config/__fixtures__/**" + # Scratch projects written by the eslint-config tests; each has a package.json and + # would otherwise be registered as a workspace project by an install during a test run. + - "!packages/eslint-config/tmp_fixtures/**" packageExtensions: - "@visulima/fs": - dependencies: - "@visulima/yaml": "1.0.0" - # eslint-plugin-compat requires caniuse-lite from its caniuse provider but does not declare - # it, so pnpm's isolated linker cannot resolve it and loading the plugin throws - # MODULE_NOT_FOUND. The range matches browserslist's own so the two share one copy. - # Remove once https://github.com/amilajack/eslint-plugin-compat declares the dependency. - eslint-plugin-compat: - dependencies: - caniuse-lite: "^1.0.30001809" + "@visulima/fs": + dependencies: + "@visulima/yaml": "1.0.0" + # eslint-plugin-compat requires caniuse-lite from its caniuse provider but does not declare + # it, so pnpm's isolated linker cannot resolve it and loading the plugin throws + # MODULE_NOT_FOUND. The range matches browserslist's own so the two share one copy. + # Remove once https://github.com/amilajack/eslint-plugin-compat declares the dependency. + eslint-plugin-compat: + dependencies: + caniuse-lite: "^1.0.30001809" auditConfig: - ignoreCves: - - GHSA-v2wj-q39q-566r - - GHSA-p9ff-h696-f583 - - GHSA-4w7w-66w2-5vf9 + ignoreCves: + - GHSA-v2wj-q39q-566r + - GHSA-p9ff-h696-f583 + - GHSA-4w7w-66w2-5vf9 catalog: + "@anolilab/multi-semantic-release": 4.4.7 + "@commitlint/cli": 21.2.2 + "@commitlint/config-conventional": 21.2.2 + "@commitlint/core": 21.2.2 + "@eslint/css": 1.4.0 + "@secretlint/secretlint-rule-preset-recommend": 13.0.5 + "@types/node": 26.1.1 + "@vitest/coverage-v8": 4.1.11 + commitizen: ^4.3.2 + conventional-changelog-conventionalcommits: 9.3.1 + cross-env: ^10.1.0 + cz-conventional-changelog: ^3.3.0 + eslint: 10.8.0 + husky: ^9.1.7 + is-ci: ^4.1.0 + lint-staged: 17.3.0 + nx: 23.1.1 + pkg-pr-new: 0.0.88 + postcss: 8.5.25 + prettier: 3.9.6 + publint: 0.3.23 + read-pkg: 10.1.0 + rimraf: 6.1.3 + secretlint: 13.0.5 + semantic-release: 25.0.9 + sort-package-json: 4.0.0 + stylelint: 17.14.1 + textlint: 15.8.0 + typescript: 6.0.3 + vite: 8.2.0 + vitest: 4.1.10 +catalogMode: prefer + +catalogs: + build: + esbuild: 0.28.2 + vite: 8.2.0 + cli: "@anolilab/multi-semantic-release": 4.4.7 + "@anolilab/semantic-release-pnpm": 8.1.18 + "@anolilab/semantic-release-preset": 13.4.19 + commitizen: ^4.3.2 + semantic-release: 25.0.9 + dev: + "@arethetypeswrong/cli": ^0.18.5 + "@visulima/packem": 2.0.0-alpha.98 + frontend: + react: 19.2.8 + lint: + "@anolilab/eslint-config": 30.0.1 + "@anolilab/prettier-config": 10.0.3 "@commitlint/cli": 21.2.2 "@commitlint/config-conventional": 21.2.2 "@commitlint/core": 21.2.2 + "@e18e/eslint-plugin": 0.8.0 + "@eslint-community/eslint-plugin-eslint-comments": 4.7.2 + "@eslint-react/eslint-plugin": 5.18.6 + "@eslint/compat": 2.1.0 + "@eslint/config-inspector": 3.2.0 "@eslint/css": 1.4.0 + "@eslint/js": 10.0.1 + "@eslint/markdown": 8.0.3 + "@html-eslint/eslint-plugin": 0.65.0 + "@html-eslint/parser": 0.65.0 + "@ospm/eslint-plugin-react-unhookify": ^1.0.2 "@secretlint/secretlint-rule-preset-recommend": 13.0.5 - "@types/node": 26.1.1 - "@vitest/coverage-v8": 4.1.11 - commitizen: ^4.3.2 - conventional-changelog-conventionalcommits: 9.3.1 - cross-env: ^10.1.0 - cz-conventional-changelog: ^3.3.0 + "@stylistic/eslint-plugin": 5.10.0 + "@stylistic/eslint-plugin-migrate": ^4.4.1 + "@stylistic/eslint-plugin-ts": ^4.4.1 + "@tanstack/eslint-plugin-query": 5.102.8 + "@tanstack/eslint-plugin-router": 1.162.0 + "@textlint-rule/textlint-rule-no-invalid-control-character": ^3.0.0 + "@textlint-rule/textlint-rule-no-unmatched-pair": ^2.0.4 + "@textlint-rule/textlint-rule-preset-google": ^0.1.2 + "@textlint/ast-node-types": 15.8.0 + "@textlint/types": 15.8.0 + "@unocss/eslint-plugin": 66.10.0 + "@vitest/eslint-plugin": 1.6.27 + astro-eslint-parser: 3.1.0 eslint: 10.8.0 + eslint-config-flat-gitignore: 2.3.0 + eslint-config-prettier: 10.1.8 + eslint-flat-config-utils: 3.2.0 + eslint-import-resolver-node: 0.4.0 + eslint-import-resolver-typescript: ^4.4.5 + eslint-merge-processors: ^2.0.0 + eslint-plugin-antfu: 3.2.3 + eslint-plugin-astro: 3.1.0 + eslint-plugin-compat: 7.0.2 + eslint-plugin-erasable-syntax-only: 0.4.2 + eslint-plugin-es-x: 10.0.0 + eslint-plugin-format: 2.0.1 + eslint-plugin-html: 8.1.4 + eslint-plugin-import-x: 4.17.1 + eslint-plugin-jsdoc: 63.3.3 + eslint-plugin-jsonc: 3.4.1 + eslint-plugin-jsx-a11y: ^6.10.2 + eslint-plugin-n: 18.2.2 + eslint-plugin-no-for-of-array: ^0.1.0 + eslint-plugin-no-only-tests: 3.4.0 + eslint-plugin-no-secrets: 2.3.3 + eslint-plugin-no-unsanitized: 4.1.5 + eslint-plugin-oxlint: 1.77.0 + eslint-plugin-perfectionist: 5.10.0 + eslint-plugin-playwright: 2.11.0 + eslint-plugin-pnpm: 1.7.0 + eslint-plugin-promise: 7.3.0 + eslint-plugin-react: ^7.37.5 + eslint-plugin-react-compiler: ^19.1.0-rc.2 + eslint-plugin-react-hooks: 7.1.1 + eslint-plugin-react-perf: ^3.3.3 + eslint-plugin-react-refresh: 0.5.3 + eslint-plugin-react-you-might-not-need-an-effect: 1.0.1 + eslint-plugin-regexp: 3.1.1 + eslint-plugin-security: 4.0.1 + eslint-plugin-simple-import-sort: 14.0.0 + eslint-plugin-sonarjs: 4.2.0 + eslint-plugin-storybook: 10.5.3 + eslint-plugin-tailwindcss: 4.2.0 + eslint-plugin-testing-library: 7.16.2 + eslint-plugin-toml: 1.5.0 + eslint-plugin-tsdoc: 0.5.2 + eslint-plugin-unicorn: 72.0.0 + eslint-plugin-unused-imports: 4.4.1 + eslint-plugin-validate-jsx-nesting: ^0.1.1 + eslint-plugin-yml: 3.8.1 + eslint-plugin-you-dont-need-lodash-underscore: ^6.14.0 + eslint-plugin-zod: 4.9.0 + eslint-typegen: 2.3.1 husky: ^9.1.7 - is-ci: ^4.1.0 + jsonc-eslint-parser: 3.3.0 lint-staged: 17.3.0 - nx: 23.1.1 - pkg-pr-new: 0.0.88 - postcss: 8.5.25 + oxfmt: 0.63.0 + oxlint: 1.78.0 prettier: 3.9.6 publint: 0.3.23 - read-pkg: 10.1.0 - rimraf: 6.1.3 secretlint: 13.0.5 - semantic-release: 25.0.9 - sort-package-json: 4.0.0 + storybook: 10.5.8 stylelint: 17.14.1 + stylelint-config-clean-order: 10.0.0 + stylelint-config-standard: 40.0.0 + stylelint-declaration-block-no-ignored-properties: 3.0.0 + stylelint-high-performance-animation: 2.0.0 + stylelint-no-unsupported-browser-features: 8.1.1 + stylelint-require-units: ^2.0.0 + stylelint-selector-no-empty: ^1.0.9 textlint: 15.8.0 - typescript: 6.0.3 - vite: 8.2.0 + textlint-filter-rule-comments: 1.3.0 + textlint-rule-abbr-within-parentheses: ^1.0.2 + textlint-rule-alex: ^5.0.0 + textlint-rule-apostrophe: ^3.0.0 + textlint-rule-common-misspellings: ^1.0.1 + textlint-rule-date-weekday-mismatch: ^1.1.1 + textlint-rule-diacritics: ^2.1.4 + textlint-rule-en-capitalization: ^2.0.3 + textlint-rule-footnote-order: ^1.0.3 + textlint-rule-helper: ^2.5.0 + textlint-rule-no-dead-link: 6.2.3 + textlint-rule-no-empty-section: ^1.1.0 + textlint-rule-no-todo: ^2.0.1 + textlint-rule-terminology: ^5.2.16 + textlint-rule-write-good: ^2.0.0 + toml-eslint-parser: 1.0.3 + typescript-eslint: 8.67.0 + yaml-eslint-parser: 2.1.0 + monorepo: + nx: 23.1.3 + network: + browserslist: 4.28.8 + browserslist-config-anolilab: 9.0.1 + confusing-browser-globals: ^1.0.11 + node: + cross-env: ^10.1.0 + execa: ^10.0.1 + globals: 17.11.0 + pkg-pr-new: 0.0.88 + read-pkg: 10.1.0 + rimraf: 6.1.3 + tinyglobby: 0.2.17 + peer: + nano-staged: 1.0.2 + prod: + "@visulima/fs": 5.0.5 + "@visulima/package": ^5.0.5 + conventional-changelog-conventionalcommits: 9.3.1 + cz-conventional-changelog: ^3.3.0 + is-ci: ^4.1.0 + parse-gitignore: ^2.0.0 + shell-quote: ^1.10.0 + sort-package-json: 4.0.0 + type-fest: 5.8.0 + write-good: ^1.0.8 + script: + tsx: ^4.23.12 + style: + postcss: 8.5.25 + tailwind-csstree: 0.3.3 + test: + "@testing-library/dom": ^10.4.1 + "@vitest/coverage-v8": 4.1.11 vitest: 4.1.10 -catalogMode: prefer - -catalogs: - build: - esbuild: 0.28.2 - vite: 8.2.0 - cli: - "@anolilab/multi-semantic-release": 4.4.7 - "@anolilab/semantic-release-pnpm": 8.1.18 - "@anolilab/semantic-release-preset": 13.4.19 - commitizen: ^4.3.2 - semantic-release: 25.0.9 - dev: - "@arethetypeswrong/cli": ^0.18.5 - "@visulima/packem": 2.0.0-alpha.98 - frontend: - react: 19.2.8 - lint: - "@anolilab/eslint-config": 30.0.1 - "@anolilab/prettier-config": 10.0.3 - "@commitlint/cli": 21.2.2 - "@commitlint/config-conventional": 21.2.2 - "@commitlint/core": 21.2.2 - "@e18e/eslint-plugin": 0.8.0 - "@eslint-community/eslint-plugin-eslint-comments": 4.7.2 - "@eslint-react/eslint-plugin": 5.18.6 - "@eslint/compat": 2.1.0 - "@eslint/config-inspector": 3.2.0 - "@eslint/css": 1.4.0 - "@eslint/js": 10.0.1 - "@eslint/markdown": 8.0.3 - "@html-eslint/eslint-plugin": 0.65.0 - "@html-eslint/parser": 0.65.0 - "@ospm/eslint-plugin-react-unhookify": ^1.0.2 - "@secretlint/secretlint-rule-preset-recommend": 13.0.5 - "@stylistic/eslint-plugin": 5.10.0 - "@stylistic/eslint-plugin-migrate": ^4.4.1 - "@stylistic/eslint-plugin-ts": ^4.4.1 - "@tanstack/eslint-plugin-query": 5.102.8 - "@tanstack/eslint-plugin-router": 1.162.0 - "@textlint-rule/textlint-rule-no-invalid-control-character": ^3.0.0 - "@textlint-rule/textlint-rule-no-unmatched-pair": ^2.0.4 - "@textlint-rule/textlint-rule-preset-google": ^0.1.2 - "@textlint/ast-node-types": 15.8.0 - "@textlint/types": 15.8.0 - "@unocss/eslint-plugin": 66.10.0 - "@vitest/eslint-plugin": 1.6.27 - astro-eslint-parser: 3.1.0 - eslint: 10.8.0 - eslint-config-flat-gitignore: 2.3.0 - eslint-config-prettier: 10.1.8 - eslint-flat-config-utils: 3.2.0 - eslint-import-resolver-node: 0.4.0 - eslint-import-resolver-typescript: ^4.4.5 - eslint-merge-processors: ^2.0.0 - eslint-plugin-antfu: 3.2.3 - eslint-plugin-astro: 3.1.0 - eslint-plugin-compat: 7.0.2 - eslint-plugin-erasable-syntax-only: 0.4.2 - eslint-plugin-es-x: 10.0.0 - eslint-plugin-format: 2.0.1 - eslint-plugin-html: 8.1.4 - eslint-plugin-import-x: 4.17.1 - eslint-plugin-jsdoc: 63.3.3 - eslint-plugin-jsonc: 3.4.1 - eslint-plugin-jsx-a11y: ^6.10.2 - eslint-plugin-n: 18.2.2 - eslint-plugin-no-for-of-array: ^0.1.0 - eslint-plugin-no-only-tests: 3.4.0 - eslint-plugin-no-secrets: 2.3.3 - eslint-plugin-no-unsanitized: 4.1.5 - eslint-plugin-oxlint: 1.77.0 - eslint-plugin-perfectionist: 5.10.0 - eslint-plugin-playwright: 2.11.0 - eslint-plugin-pnpm: 1.7.0 - eslint-plugin-promise: 7.3.0 - eslint-plugin-react: ^7.37.5 - eslint-plugin-react-compiler: ^19.1.0-rc.2 - eslint-plugin-react-hooks: 7.1.1 - eslint-plugin-react-perf: ^3.3.3 - eslint-plugin-react-refresh: 0.5.3 - eslint-plugin-react-you-might-not-need-an-effect: 1.0.1 - eslint-plugin-regexp: 3.1.1 - eslint-plugin-security: 4.0.1 - eslint-plugin-simple-import-sort: 14.0.0 - eslint-plugin-sonarjs: 4.2.0 - eslint-plugin-storybook: 10.5.3 - eslint-plugin-tailwindcss: 4.2.0 - eslint-plugin-testing-library: 7.16.2 - eslint-plugin-toml: 1.5.0 - eslint-plugin-tsdoc: 0.5.2 - eslint-plugin-unicorn: 72.0.0 - eslint-plugin-unused-imports: 4.4.1 - eslint-plugin-validate-jsx-nesting: ^0.1.1 - eslint-plugin-yml: 3.8.1 - eslint-plugin-you-dont-need-lodash-underscore: ^6.14.0 - eslint-plugin-zod: 4.9.0 - eslint-typegen: 2.3.1 - husky: ^9.1.7 - jsonc-eslint-parser: 3.3.0 - lint-staged: 17.3.0 - oxfmt: 0.63.0 - oxlint: 1.78.0 - prettier: 3.9.6 - publint: 0.3.23 - secretlint: 13.0.5 - storybook: 10.5.8 - stylelint: 17.14.1 - stylelint-config-clean-order: 10.0.0 - stylelint-config-standard: 40.0.0 - stylelint-declaration-block-no-ignored-properties: 3.0.0 - stylelint-high-performance-animation: 2.0.0 - stylelint-no-unsupported-browser-features: 8.1.1 - stylelint-require-units: ^2.0.0 - stylelint-selector-no-empty: ^1.0.9 - textlint: 15.8.0 - textlint-filter-rule-comments: 1.3.0 - textlint-rule-abbr-within-parentheses: ^1.0.2 - textlint-rule-alex: ^5.0.0 - textlint-rule-apostrophe: ^3.0.0 - textlint-rule-common-misspellings: ^1.0.1 - textlint-rule-date-weekday-mismatch: ^1.1.1 - textlint-rule-diacritics: ^2.1.4 - textlint-rule-en-capitalization: ^2.0.3 - textlint-rule-footnote-order: ^1.0.3 - textlint-rule-helper: ^2.5.0 - textlint-rule-no-dead-link: 6.2.3 - textlint-rule-no-empty-section: ^1.1.0 - textlint-rule-no-todo: ^2.0.1 - textlint-rule-terminology: ^5.2.16 - textlint-rule-write-good: ^2.0.0 - toml-eslint-parser: 1.0.3 - typescript-eslint: 8.67.0 - yaml-eslint-parser: 2.1.0 - monorepo: - nx: 23.1.3 - network: - browserslist: 4.28.8 - browserslist-config-anolilab: 9.0.1 - confusing-browser-globals: ^1.0.11 - node: - cross-env: ^10.1.0 - execa: ^10.0.1 - globals: 17.11.0 - pkg-pr-new: 0.0.88 - read-pkg: 10.1.0 - rimraf: 6.1.3 - tinyglobby: 0.2.17 - peer: - nano-staged: 1.0.2 - prod: - "@visulima/fs": 5.0.5 - "@visulima/package": ^5.0.5 - conventional-changelog-conventionalcommits: 9.3.1 - cz-conventional-changelog: ^3.3.0 - is-ci: ^4.1.0 - parse-gitignore: ^2.0.0 - shell-quote: ^1.10.0 - sort-package-json: 4.0.0 - type-fest: 5.8.0 - write-good: ^1.0.8 - script: - tsx: ^4.23.12 - style: - postcss: 8.5.25 - tailwind-csstree: 0.3.3 - test: - "@testing-library/dom": ^10.4.1 - "@vitest/coverage-v8": 4.1.11 - vitest: 4.1.10 - tsc: - "@total-typescript/ts-reset": ^0.6.1 - "@visulima/tsconfig": ^3.2.0 - typescript: 6.0.3 - types: - "@types/confusing-browser-globals": ^1.0.3 - "@types/eslint": ^9.6.1 - "@types/eslint-plugin-jsx-a11y": ^6.10.1 - "@types/eslint-plugin-tailwindcss": ^3.17.0 - "@types/node": 26.1.1 - "@types/semver": ^7.7.1 - "@types/shell-quote": ^1.7.5 - "@typescript-eslint/parser": 8.66.0 - "@typescript-eslint/types": 8.66.0 - utils: - caniuse-lite: 1.0.30001809 - semver: 7.8.5 - conflicts_lint_10_0_2: - "@anolilab/prettier-config": 10.0.3 + tsc: + "@total-typescript/ts-reset": ^0.6.1 + "@visulima/tsconfig": ^3.2.0 + typescript: 6.0.3 + types: + "@types/confusing-browser-globals": ^1.0.3 + "@types/eslint": ^9.6.1 + "@types/eslint-plugin-jsx-a11y": ^6.10.1 + "@types/eslint-plugin-tailwindcss": ^3.17.0 + "@types/node": 26.1.1 + "@types/semver": ^7.7.1 + "@types/shell-quote": ^1.7.5 + "@typescript-eslint/parser": 8.66.0 + "@typescript-eslint/types": 8.66.0 + utils: + caniuse-lite: 1.0.30001809 + semver: 7.8.5 + conflicts_lint_10_0_2: + "@anolilab/prettier-config": 10.0.3 onlyBuiltDependencies: - - esbuild - - nx - - oxc-resolver - - rs-module-lexer - - unrs-resolver + - esbuild + - nx + - oxc-resolver + - rs-module-lexer + - unrs-resolver overrides: - axios@>=1.0.0 <=1.13.4: ">=1.19.0" - # GHSA-pmv8-rq9r-6j72, GHSA-xj6q-8x83-jv6g, GHSA-42h9-826w-cgv3 — all patched in 1.18.0 - axios@<1.18.0: ">=1.19.0" - # GHSA-v422-hmwv-36x6 - body-parser@>=2.0.0 <2.3.0: ">=2.3.0" - # GHSA-3jxr-9vmj-r5cp (ReDoS) — patched per major line: 1.1.16, 2.1.2, 5.0.7 - brace-expansion@1: ">=5.0.9" - brace-expansion@2: ">=5.0.9" - brace-expansion@>=3.0.0 <5.0.9: ">=5.0.9" - browserslist@<=4.28.6: ">=4.28.7" - chrono-node@<2.2.4: ">=2.10.1" - defu@<=6.1.4: ">=6.1.7" - # The published @anolilab/eslint-config pulls sonarjs 4.0.3 transitively, which reads - # AST_NODE_TYPES.FunctionType at load and crashes against eslint 10.7. Sibling packages - # lint themselves with the published config, so force the version this workspace uses. - eslint-plugin-sonarjs@<4.2.0: ">=4.2.0" - # GHSA-32gv-6cf3-8cmc - fast-uri@>=3.0.0 <3.1.3: "^4.1.2" - # GHSA-7p8r-x3mc-p8w7 (host confusion via backslash) - fast-uri@>=4.0.0 <4.1.2: "^4.1.2" - fast-uri@4.1.1: "^4.1.2" + axios@>=1.0.0 <=1.13.4: ">=1.19.0" + # GHSA-pmv8-rq9r-6j72, GHSA-xj6q-8x83-jv6g, GHSA-42h9-826w-cgv3 — all patched in 1.18.0 + axios@<1.18.0: ">=1.19.0" + # GHSA-v422-hmwv-36x6 + body-parser@>=2.0.0 <2.3.0: ">=2.3.0" + # GHSA-3jxr-9vmj-r5cp (ReDoS) — patched per major line: 1.1.16, 2.1.2, 5.0.7 + brace-expansion@1: ">=5.0.9" + brace-expansion@2: ">=5.0.9" + brace-expansion@>=3.0.0 <5.0.9: ">=5.0.9" + browserslist@<=4.28.6: ">=4.28.7" + chrono-node@<2.2.4: ">=2.10.1" + defu@<=6.1.4: ">=6.1.7" + # The published @anolilab/eslint-config pulls sonarjs 4.0.3 transitively, which reads + # AST_NODE_TYPES.FunctionType at load and crashes against eslint 10.7. Sibling packages + # lint themselves with the published config, so force the version this workspace uses. + eslint-plugin-sonarjs@<4.2.0: ">=4.2.0" + # GHSA-32gv-6cf3-8cmc + fast-uri@>=3.0.0 <3.1.3: "^4.1.2" + # GHSA-7p8r-x3mc-p8w7 (host confusion via backslash) + fast-uri@>=4.0.0 <4.1.2: "^4.1.2" + fast-uri@4.1.1: "^4.1.2" - follow-redirects@<=1.15.11: ">=1.16.0" - # GHSA-p3x2-7fjr-vqmv (path traversal) - "@hono/node-server@<2.0.5": ">=2.1.1" - # GHSA-xgm2-5f3f-mvvc - hono@<4.12.27: ">=4.13.2" - ip-address@<=10.1.0: ">=10.5.0" - # GHSA-5p4m-2wfm-xmqj (Quadratuc CPU in !!omap) — jest's load-nyc-config pulls 3.x. - # Do not raise to v5; see the js-yaml@>=4.0.0 note below. - js-yaml@>=3.0.0 <3.15.1: "^3.15.1" - lodash-es@<=4.17.23: ">=4.18.0" - lodash-es@>=4.0.0 <=4.17.23: ">=4.18.0" - lodash@<=4.17.23: ">=4.18.0" - lodash@>=4.0.0 <=4.17.22: ">=4.18.1" - lodash@>=4.0.0 <=4.17.23: ">=4.18.0" - # GHSA-2v37-7h3g-55p8 (custom generators loop indefinitely when size is zero) - nanoid@<5.1.16: ">=5.1.16" - picomatch@>=4.0.0 <4.0.4: ">=4.0.5" - postcss@<8.5.10: ">=8.5.25" - shell-quote@>=1.1.0 <=1.8.3: ">=1.10.0" - # GHSA-2p49-hgcm-8545 - svgo@>=4.0.0 <4.0.2: ">=4.0.2" - tmp@<0.2.7: ">=0.2.7" - undici@<6.23.0: ">=8.10.0" - undici@<6.24.0: ">=8.10.0" - undici@>=7.0.0 <7.28.0: "8.10.0" - undici@>=8.0.0 <8.5.0: "8.10.0" - "@actions/http-client>undici": "8.10.0" - vite@>=7.0.0 <=7.3.1: ">=7.3.2" - vite@>=7.1.0 <=7.3.1: ">=7.3.2" - vite@>=8.0.0 <=8.0.15: ">=8.2.0" - yaml@>=2.0.0 <2.8.3: ">=2.9.0" - esbuild@>=0.27.3 <0.28.1: ">=0.28.2" - form-data@>=4.0.0 <4.0.6: ">=4.0.6" - # Stay on 4.x: js-yaml 5.x is ESM-only with no default export and breaks - # multi-semantic-release's `import ... from "js-yaml"`. ^4.3.0 still patches GHSA-52cp-r559-cp3m. - js-yaml@>=4.0.0 <4.3.0: "^4.3.1" + follow-redirects@<=1.15.11: ">=1.16.0" + # GHSA-p3x2-7fjr-vqmv (path traversal) + "@hono/node-server@<2.0.5": ">=2.1.1" + # GHSA-xgm2-5f3f-mvvc + hono@<4.12.27: ">=4.13.2" + ip-address@<=10.1.0: ">=10.5.0" + # GHSA-5p4m-2wfm-xmqj (Quadratuc CPU in !!omap) — jest's load-nyc-config pulls 3.x. + # Do not raise to v5; see the js-yaml@>=4.0.0 note below. + js-yaml@>=3.0.0 <3.15.1: "^3.15.1" + lodash-es@<=4.17.23: ">=4.18.0" + lodash-es@>=4.0.0 <=4.17.23: ">=4.18.0" + lodash@<=4.17.23: ">=4.18.0" + lodash@>=4.0.0 <=4.17.22: ">=4.18.1" + lodash@>=4.0.0 <=4.17.23: ">=4.18.0" + # GHSA-2v37-7h3g-55p8 (custom generators loop indefinitely when size is zero) + nanoid@<5.1.16: ">=5.1.16" + picomatch@>=4.0.0 <4.0.4: ">=4.0.5" + postcss@<8.5.10: ">=8.5.25" + shell-quote@>=1.1.0 <=1.8.3: ">=1.10.0" + # GHSA-2p49-hgcm-8545 + svgo@>=4.0.0 <4.0.2: ">=4.0.2" + tmp@<0.2.7: ">=0.2.7" + undici@<6.23.0: ">=8.10.2" + undici@<6.24.0: ">=8.10.0" + undici@>=7.0.0 <7.28.0: "8.10.0" + undici@>=8.0.0 <8.5.0: "8.10.0" + "@actions/http-client>undici": "8.10.0" + vite@>=7.0.0 <=7.3.1: ">=7.3.2" + vite@>=7.1.0 <=7.3.1: ">=7.3.2" + vite@>=8.0.0 <=8.0.15: ">=8.2.0" + yaml@>=2.0.0 <2.8.3: ">=2.9.0" + esbuild@>=0.27.3 <0.28.1: ">=0.28.2" + form-data@>=4.0.0 <4.0.6: ">=4.0.6" + # Stay on 4.x: js-yaml 5.x is ESM-only with no default export and breaks + # multi-semantic-release's `import ... from "js-yaml"`. ^4.3.0 still patches GHSA-52cp-r559-cp3m. + js-yaml@>=4.0.0 <4.3.0: "^4.3.1" shellEmulator: true @@ -316,21 +316,23 @@ trustPolicyIgnoreAfter: 1440 minimumReleaseAge: 1440 minimumReleaseAgeExclude: - - "@anolilab/*" - - "browserslist-config-anolilab" - - "@visulima/fs@5.0.5" - - "@visulima/packem-rollup@1.0.0-alpha.80" - - "@visulima/packem-share@1.0.0-alpha.55" - - "@visulima/packem@2.0.0-alpha.98" - - "@visulima/rollup-plugin-css@1.0.0-alpha.59" - - "@visulima/rollup-plugin-dts@1.0.0-alpha.40" - - "@visulima/tsconfig@3.2.0" + - "@anolilab/*" + - "browserslist-config-anolilab" + - "@visulima/fs@5.0.5" + - "@visulima/packem-rollup@1.0.0-alpha.80" + - "@visulima/packem-share@1.0.0-alpha.55" + - "@visulima/packem@2.0.0-alpha.98" + - "@visulima/rollup-plugin-css@1.0.0-alpha.59" + - "@visulima/rollup-plugin-dts@1.0.0-alpha.40" + - "@visulima/tsconfig@3.2.0" + # Renovate security update: undici@8.10.2 + - undici@8.10.2 blockExoticSubdeps: true allowBuilds: - "@parcel/watcher": true - esbuild: true - nx: true - rs-module-lexer: true - unrs-resolver: true + "@parcel/watcher": true + esbuild: true + nx: true + rs-module-lexer: true + unrs-resolver: true