[chhoumann]

Summary

Resolve all six open Dependabot alerts and the additional fast-uri advisory in development dependencies. Both the root and docs audits report zero vulnerabilities. The production plugin bundle is byte-identical.

Upgrade Obsidian to 1.14.4, which declares patched Moment. The latest linter still pins an older Obsidian package, so its Moment dependency needs a scoped override. The latest obsidian-e2e still requires a vite-plus version that pins vulnerable oxfmt. Override that formatter with the project's existing patched oxfmt through $oxfmt. This removes the obsolete formatter and its native bindings. Remove the obsolete brace-expansion overrides and refresh compatible brace-expansion and fast-uri versions.

Obsidian requires newer CodeMirror peers and separate copies of the linter's older peers. CodeMirror remains external to the bundle. PodNotes uses vite-plus/test through obsidian-e2e and never runs vp; that test entry does not use oxfmt. Remove the Moment override when the linter ships patched Moment. Remove the formatter override when obsidian-e2e permits a vite-plus release whose formatter already uses patched Tinypool.

The advisory evidence follows. All paths start at PodNotes.

Alert and advisory	Dependency path before	Dependency path after
#211, GHSA-5gmw-xhrv-c9v3, tinypool <=2.1.0	obsidian-e2e 0.13.0 > vite-plus 0.1.24 > oxfmt 0.52.0 > tinypool 2.1.0	obsidian-e2e 0.13.0 > vite-plus 0.1.24 > shared oxfmt 0.71.0 > tinypool 2.2.0
#210, GHSA-85c8-ppgw-ccpr, tinypool <2.1.2	obsidian-e2e 0.13.0 > vite-plus 0.1.24 > oxfmt 0.52.0 > tinypool 2.1.0	obsidian-e2e 0.13.0 > vite-plus 0.1.24 > shared oxfmt 0.71.0 > tinypool 2.2.0
#202, GHSA-4p3w-j4w9-5jqw, moment >=2.29.2 <2.31.0	obsidian 1.13.1 > moment 2.29.4; also eslint-plugin-obsidianmd 0.4.2 > obsidian 1.12.3 > moment 2.29.4	obsidian 1.14.4 > moment 2.31.0; also eslint-plugin-obsidianmd 0.4.2 > obsidian 1.12.3 > shared moment 2.31.0
#201, GHSA-q2hr-2g5m-vwhr, brace-expansion <1.1.21	eslint-plugin-obsidianmd 0.4.2 > eslint 9.39.1 > minimatch 3.1.5 > brace-expansion 1.1.18	Same parent versions > brace-expansion 1.1.21 in all five copies
#200, GHSA-q2hr-2g5m-vwhr, brace-expansion >=2.0.0 <2.1.7	eslint-plugin-obsidianmd 0.4.2 > eslint-plugin-json-schema-validator 5.1.0 > minimatch 8.0.7 > brace-expansion 2.1.4	Same parent versions > brace-expansion 2.1.7; also shared with minimatch 9.0.9 under the linter
#199, GHSA-q2hr-2g5m-vwhr, brace-expansion >=4.0.0 <5.0.12	eslint-plugin-obsidianmd 0.4.2 > typescript-eslint 8.62.0 > typescript-estree 8.62.0 > minimatch 10.2.5 > brace-expansion 5.0.9	Same parent versions > brace-expansion 5.0.12 in both typescript-estree copies
GHSA-hrr3-gc8f-f4qj, fast-uri >=3.0.0 <3.1.8, moderate	eslint-plugin-obsidianmd 0.4.2 > eslint-plugin-json-schema-validator 5.1.0 > ajv 8.20.0 > fast-uri 3.1.7	Same parent versions > fast-uri 3.1.8

Brace-expansion and fast-uri already fit their parents' declared ranges, so they need no new overrides or parent upgrades. Docs contains none of the four affected packages and its lockfile is unchanged. Unrelated lock entries, including libc, stay intact.

Verification

• Node 22.23.2 and npm 10.9.8. npm ci, npm ls tinypool moment brace-expansion fast-uri, npm ls --all, root npm audit, and npm audit --prefix docs pass. Both audits report zero vulnerabilities.
• npm run lint, npm run format:check, npm run typecheck, npm run build, npm run test, and npm run docs:build pass. All 86 unit test files and 1,386 tests pass. Docs builds 15 pages, validates internal links, and resolves 73 legacy fragments.
• npm run size passes at 314,794 raw bytes and 99,368 gzip bytes. cmp confirms byte equality with the pre-change bundle. SHA-256 is 296b01118a4530ead44ac42ce552011867859a07e1bdc1963840a3c1da8a729f.
• npm run test:e2e passes all 11 files and 53 tests in isolated Obsidian 1.13.7 on headless Linux, vault podnotes-chore-dependabot-alerts. The suite uses local fixture feeds and WAV audio, covers playback, URI, local-file, sync, popout, and quit persistence, and restores fixture state. The instance is stopped, and the stop dry-run reports no PIDs.

PodNotes imports neither Moment nor the other affected packages. Obsidian is external to the bundle, and PodNotes uses its own date formatter. The isolated app supplies window.moment 2.30.1 independently of the development package. Updating the lock does not replace the host's Moment.

Release impact

The current public Obsidian version is 1.14.4. Both the desktop and mobile changelogs mark the October 5 release as public. The stable desktop updater also reports latestVersion: 1.14.4.

minAppVersion stays at 1.13.0. The newer declarations require three secret-selection parameters to accept string | null; the existing clear-selection branch already handles null. Those type edits erase from JavaScript. No settings, storage, public API, URI, or migration changes.

Note

Resolve dev dependency alerts and fix null credential selection in settings

• Updates the Obsidian dev dependency from 1.13.1 to 1.14.4 and replaces the brace-expansion overrides with targeted overrides: Moment 2.31.0 for eslint-plugin-obsidianmd, and oxfmt for vite-plus pinned to the manifest's version, in package.json and package-lock.json
• Fixes the credential settings handlers in PodNotesSettingsTab.ts: handleSecretSelection, saveSecretReference, and persistSecretReference now accept a null selection and persist an empty credential reference instead of requiring an identifier
• Behavioral Change: clearing the credential selection in settings now saves an empty reference rather than being rejected

^{Macroscope summarized be5d902.}