chore(deps): pin vulnerable transitive dependencies to patched versions

[juliusmarminge]

Enabling Dependabot alerts on the repo surfaced ~135 advisories against pnpm-lock.yaml. Nearly all of them are transitive dependencies of build tooling (electron-builder, alchemy, @clerk/expo, and the Claude Agent SDK's MCP dependency) whose parents have not yet shipped a release lifting the floor.

This adds a block of overrides in pnpm-workspace.yaml pinning each affected package to its patched release. Every key is scoped to the major the dependents already declare ("tar@7", "brace-expansion@1" / "@2" / "@5", …) so no edge is forced across a breaking version — undici@8 under @effect/platform-node, path-to-regexp@8 under router, and undici@6 under node-gyp are all left where they were.

On top of #12411 (already merged), pnpm audit goes from 122 advisories to 5 (2 high / 3 moderate). What remains has no patched release within the declared major and needs the parent to move:

• image-size@1 (metro)
• uuid@7 (xcode)
• decode-uri-component@0.2 (query-string)
• xml2js@0.4 (dbus-next)

Verified with vp run typecheck in apps/server, apps/desktop, and infra/relay, plus vp test run for the relay suite and the server's Claude-related tests.

Made with Claude Fable 5 via Claude Code in T3 Code.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated transitive dependency versions to address known security vulnerabilities while preserving their existing major-version compatibility.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR updates a broad set of transitive dependencies, including packages used by existing server and network paths, through workspace overrides and lockfile rewrites. Its explicit security scope and cross-cutting runtime dependency impact warrant explicit human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: e2791a1a-acf8-4b8b-9db7-d38592a8550f

📥 Commits

Reviewing files that changed from the base of the PR and between 56a9bf2 and 8a78aa4.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The workspace configuration adds scoped pnpm overrides for vulnerable transitive dependencies. Each override pins a package to a specified security version within its declared major-version line.

Changes

Dependency Security Floors

Layer / File(s)	Summary
Scoped dependency overrides pnpm-workspace.yaml	Adds security-floor overrides for 23 transitive dependencies, including tar, form-data, js-yaml, undici, lodash, qs, postcss, hono, and @hono/node-server.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to 8a78a

The dependency security-floor changes have no identified merge-blocking risk and are mergeable with normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning vulnerable transitive dependencies to patched versions.
Description check	✅ Passed	The description explains what changed, why the change was needed, the security impact, remaining advisories, and validation performed. It does not include the template checklist, but the required subs…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+10 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.1 KiB	+9 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.3 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	−6 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−8 B (−0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 56a9bf2 · PR result: 8a78aa4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[juliusmarminge]

Superseded by #12417, which bumps the parent dependencies instead of pinning transitives.