chore(audit): various upgrades by tackley · Pull Request #206 · brave/brave-ads-docs

tackley · 2026-07-28T08:35:37Z

To address:

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ brace-expansion: DoS via exponential-time expansion of │
│                     │ consecutive non-expanding {} groups                    │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ brace-expansion                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <1.1.16                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.1.16                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>serve-handler>minimatch>brace-      │
│                     │ expansion                                              │
│                     │                                                        │
│                     │ .>@docusaurus/plugin-client-redirects>@docusaurus/     │
│                     │ core>serve-handler>minimatch>brace-expansion           │
│                     │                                                        │
│                     │ .>@docusaurus/preset-classic>@docusaurus/core>serve-   │
│                     │ handler>minimatch>brace-expansion                      │
│                     │                                                        │
│                     │ ... Found 26 paths, run `pnpm why brace-expansion` for │
│                     │ more information                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-3jxr-9vmj-r5cp      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ SVGO removeScripts plugin leaves some executable       │
│                     │ scripts intact                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ svgo                                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.0.0 <3.3.4                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.3.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>cssnano>cssnano-preset-default>postcss-         │
│                     │ svgo>svgo                                              │
│                     │                                                        │
│                     │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/utils-common>@docusaurus/            │
│                     │ types>webpack>minimizer-webpack-                       │
│                     │ plugin>cssnano>cssnano-preset-default>postcss-         │
│                     │ svgo>svgo                                              │
│                     │                                                        │
│                     │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>file-loader>webpack>minimizer-webpack-           │
│                     │ plugin>cssnano>cssnano-preset-default>postcss-         │
│                     │ svgo>svgo                                              │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why svgo` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-2p49-hgcm-8545      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ fast-uri vulnerable to host confusion via literal      │
│                     │ backslash authority delimiter                          │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ fast-uri                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=3.0.0 <=3.1.3                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.1.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>schema-utils>ajv>fast-uri                       │
│                     │                                                        │
│                     │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>schema-utils>ajv-formats>ajv>fast-uri           │
│                     │                                                        │
│                     │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>schema-utils>ajv-keywords>ajv>fast-uri          │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why fast-uri` for more  │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v2hh-gcrm-f6hx      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ PostCSS: Path Traversal in Previous Source Map         │
│                     │ Auto-Loading (sourceMappingURL) leads to Arbitrary     │
│                     │ .map File Disclosure                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ postcss                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=8.5.17                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=8.5.18                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>cssnano>cssnano-preset-default>css-declaration- │
│                     │ sorter>postcss                                         │
│                     │                                                        │
│                     │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>cssnano>cssnano-preset-default>cssnano-         │
│                     │ utils>postcss                                          │
│                     │                                                        │
│                     │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/      │
│                     │ utils>@docusaurus/types>webpack>minimizer-webpack-     │
│                     │ plugin>cssnano>cssnano-preset-default>postcss          │
│                     │                                                        │
│                     │ ... Found 100 paths, run `pnpm why postcss` for more   │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r28c-9q8g-f849      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ brace-expansion: DoS via unbounded expansion length    │
│                     │ causing an out-of-memory process crash                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ brace-expansion                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=5.0.7                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=5.0.8                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>serve-handler>minimatch>brace-      │
│                     │ expansion                                              │
│                     │                                                        │
│                     │ .>@docusaurus/plugin-client-redirects>@docusaurus/     │
│                     │ core>serve-handler>minimatch>brace-expansion           │
│                     │                                                        │
│                     │ .>@docusaurus/preset-classic>@docusaurus/core>serve-   │
│                     │ handler>minimatch>brace-expansion                      │
│                     │                                                        │
│                     │ ... Found 26 paths, run `pnpm why brace-expansion` for │
│                     │ more information                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-mh99-v99m-4gvg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ webpack-dev-server vulnerable to cross-site request    │
│                     │ forgery via internal developer endpoints               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ webpack-dev-server                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=5.2.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=5.2.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>webpack-dev-server                  │
│                     │                                                        │
│                     │ .>@docusaurus/plugin-client-redirects>@docusaurus/     │
│                     │ core>webpack-dev-server                                │
│                     │                                                        │
│                     │ .>@docusaurus/preset-classic>@docusaurus/core>webpack- │
│                     │ dev-server                                             │
│                     │                                                        │
│                     │ ... Found 26 paths, run `pnpm why webpack-dev-server`  │
│                     │ for more information                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-f5vj-f2hx-8m93      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ webpack-dev-server vulnerable to denial of service via │
│                     │ a malformed Host or Origin header                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ webpack-dev-server                                     │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=5.2.5                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=5.2.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>webpack-dev-server                  │
│                     │                                                        │
│                     │ .>@docusaurus/plugin-client-redirects>@docusaurus/     │
│                     │ core>webpack-dev-server                                │
│                     │                                                        │
│                     │ .>@docusaurus/preset-classic>@docusaurus/core>webpack- │
│                     │ dev-server                                             │
│                     │                                                        │
│                     │ ... Found 26 paths, run `pnpm why webpack-dev-server`  │
│                     │ for more information                                   │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-m28w-2pqf-7qgj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ body-parser vulnerable to denial of service when       │
│                     │ invalid limit value silently disables size enforcement │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ body-parser                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <1.20.6                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=1.20.6                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ .>@docusaurus/core>webpack-dev-server>express>body-    │
│                     │ parser                                                 │
│                     │                                                        │
│                     │ .>@docusaurus/plugin-client-redirects>@docusaurus/     │
│                     │ core>webpack-dev-server>express>body-parser            │
│                     │                                                        │
│                     │ .>@docusaurus/preset-classic>@docusaurus/core>webpack- │
│                     │ dev-server>express>body-parser                         │
│                     │                                                        │
│                     │ ... Found 26 paths, run `pnpm why body-parser` for     │
│                     │ more information                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-v422-hmwv-36x6      │
└─────────────────────┴────────────────────────────────────────────────────────┘
8 vulnerabilities found
Severity: 1 low | 2 moderate | 5 high

To address: ``` ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ high │ brace-expansion: DoS via exponential-time expansion of │ │ │ consecutive non-expanding {} groups │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ brace-expansion │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ <1.1.16 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=1.1.16 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>serve-handler>minimatch>brace- │ │ │ expansion │ │ │ │ │ │ .>@docusaurus/plugin-client-redirects>@docusaurus/ │ │ │ core>serve-handler>minimatch>brace-expansion │ │ │ │ │ │ .>@docusaurus/preset-classic>@docusaurus/core>serve- │ │ │ handler>minimatch>brace-expansion │ │ │ │ │ │ ... Found 26 paths, run `pnpm why brace-expansion` for │ │ │ more information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-3jxr-9vmj-r5cp │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ high │ SVGO removeScripts plugin leaves some executable │ │ │ scripts intact │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ svgo │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ >=3.0.0 <3.3.4 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=3.3.4 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>cssnano>cssnano-preset-default>postcss- │ │ │ svgo>svgo │ │ │ │ │ │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/utils-common>@docusaurus/ │ │ │ types>webpack>minimizer-webpack- │ │ │ plugin>cssnano>cssnano-preset-default>postcss- │ │ │ svgo>svgo │ │ │ │ │ │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>file-loader>webpack>minimizer-webpack- │ │ │ plugin>cssnano>cssnano-preset-default>postcss- │ │ │ svgo>svgo │ │ │ │ │ │ ... Found 100 paths, run `pnpm why svgo` for more │ │ │ information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-2p49-hgcm-8545 │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ high │ fast-uri vulnerable to host confusion via literal │ │ │ backslash authority delimiter │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ fast-uri │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ >=3.0.0 <=3.1.3 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=3.1.4 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>schema-utils>ajv>fast-uri │ │ │ │ │ │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>schema-utils>ajv-formats>ajv>fast-uri │ │ │ │ │ │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>schema-utils>ajv-keywords>ajv>fast-uri │ │ │ │ │ │ ... Found 100 paths, run `pnpm why fast-uri` for more │ │ │ information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-v2hh-gcrm-f6hx │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ high │ PostCSS: Path Traversal in Previous Source Map │ │ │ Auto-Loading (sourceMappingURL) leads to Arbitrary │ │ │ .map File Disclosure │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ postcss │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ <=8.5.17 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=8.5.18 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>cssnano>cssnano-preset-default>css-declaration- │ │ │ sorter>postcss │ │ │ │ │ │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>cssnano>cssnano-preset-default>cssnano- │ │ │ utils>postcss │ │ │ │ │ │ .>@docusaurus/core>@docusaurus/babel>@docusaurus/ │ │ │ utils>@docusaurus/types>webpack>minimizer-webpack- │ │ │ plugin>cssnano>cssnano-preset-default>postcss │ │ │ │ │ │ ... Found 100 paths, run `pnpm why postcss` for more │ │ │ information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-r28c-9q8g-f849 │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ high │ brace-expansion: DoS via unbounded expansion length │ │ │ causing an out-of-memory process crash │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ brace-expansion │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ <=5.0.7 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=5.0.8 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>serve-handler>minimatch>brace- │ │ │ expansion │ │ │ │ │ │ .>@docusaurus/plugin-client-redirects>@docusaurus/ │ │ │ core>serve-handler>minimatch>brace-expansion │ │ │ │ │ │ .>@docusaurus/preset-classic>@docusaurus/core>serve- │ │ │ handler>minimatch>brace-expansion │ │ │ │ │ │ ... Found 26 paths, run `pnpm why brace-expansion` for │ │ │ more information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-mh99-v99m-4gvg │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ moderate │ webpack-dev-server vulnerable to cross-site request │ │ │ forgery via internal developer endpoints │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ webpack-dev-server │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ <=5.2.5 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=5.2.6 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>webpack-dev-server │ │ │ │ │ │ .>@docusaurus/plugin-client-redirects>@docusaurus/ │ │ │ core>webpack-dev-server │ │ │ │ │ │ .>@docusaurus/preset-classic>@docusaurus/core>webpack- │ │ │ dev-server │ │ │ │ │ │ ... Found 26 paths, run `pnpm why webpack-dev-server` │ │ │ for more information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-f5vj-f2hx-8m93 │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ moderate │ webpack-dev-server vulnerable to denial of service via │ │ │ a malformed Host or Origin header │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ webpack-dev-server │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ <=5.2.5 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=5.2.6 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>webpack-dev-server │ │ │ │ │ │ .>@docusaurus/plugin-client-redirects>@docusaurus/ │ │ │ core>webpack-dev-server │ │ │ │ │ │ .>@docusaurus/preset-classic>@docusaurus/core>webpack- │ │ │ dev-server │ │ │ │ │ │ ... Found 26 paths, run `pnpm why webpack-dev-server` │ │ │ for more information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-m28w-2pqf-7qgj │ └─────────────────────┴────────────────────────────────────────────────────────┘ ┌─────────────────────┬────────────────────────────────────────────────────────┐ │ low │ body-parser vulnerable to denial of service when │ │ │ invalid limit value silently disables size enforcement │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Package │ body-parser │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Vulnerable versions │ <1.20.6 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Patched versions │ >=1.20.6 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ Paths │ .>@docusaurus/core>webpack-dev-server>express>body- │ │ │ parser │ │ │ │ │ │ .>@docusaurus/plugin-client-redirects>@docusaurus/ │ │ │ core>webpack-dev-server>express>body-parser │ │ │ │ │ │ .>@docusaurus/preset-classic>@docusaurus/core>webpack- │ │ │ dev-server>express>body-parser │ │ │ │ │ │ ... Found 26 paths, run `pnpm why body-parser` for │ │ │ more information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ │ More info │ GHSA-v422-hmwv-36x6 │ └─────────────────────┴────────────────────────────────────────────────────────┘ 8 vulnerabilities found Severity: 1 low | 2 moderate | 5 high ```

github-actions · 2026-07-28T08:36:26Z

[puLL-Merge] - brave/brave-ads-docs@206

Description

Security-driven dependency override bump. Adds/updates pnpm overrides for body-parser, brace-expansion, fast-uri, postcss, svgo, webpack-dev-server. Regenerates pnpm-lock.yaml accordingly. Adds packages to minimumReleaseAgeExclude to bypass the 7-day release-age gate for these security patches.

Possible Issues

@types/node transitive dep for @types/sax jumped 17.0.45 → 26.0.1. Large major bump unrelated to stated overrides; verify not accidental. Could introduce type mismatches if node types used at build.
brace-expansion split into two overrides (<1.1.16: ^1.1.16 and <=5.0.7: ^5.0.8). Lockfile only shows 5.0.8 resolved; minimumReleaseAgeExclude lists brace-expansion@1.1.16 || 5.0.8. Confirm no v1 consumer silently downgraded/broken.
brace-expansion@5.0.8 requires node: 20 || >=22; balanced-match@4.0.4 requires node: 18 || 20 || >=22. Verify CI/build node version satisfies these engine constraints.
Dropped concat-map — expected, brace-expansion@5 no longer depends on it.

Changes

Changes

pnpm-workspace.yaml

Added overrides: body-parser@<1.20.6: ^1.20.6, brace-expansion@<1.1.16: ^1.1.16, brace-expansion@<=5.0.7: ^5.0.8, fast-uri@>=3.0.0 <=3.1.3: ^3.1.4, svgo@>=3.0.0 <3.3.4: ^3.3.4.
Bumped: postcss@<8.5.10: ^8.5.10 → <=8.5.17: ^8.5.18; webpack-dev-server@<=5.2.3: ^5.2.4 → <=5.2.5: ^5.2.6.
Removed old fast-uri@<=3.1.1 / brace-expansion@^5 overrides.
Populated minimumReleaseAgeExclude with the six patched packages.

pnpm-lock.yaml

Regenerated: postcss 8.5.16→8.5.20, body-parser 1.20.5→1.20.6, brace-expansion 1.1.15→5.0.8, balanced-match 1.0.2→4.0.4, fast-uri 3.1.3→3.1.4, svgo 3.3.3→3.3.4, webpack-dev-server 5.2.5→5.2.6, nanoid 3.3.15→3.3.16.
Removed concat-map.
Mass peer-dep spec update postcss: ^8.5.10 → ^8.5.18 across @csstools/* and postcss-* packages.

sequenceDiagram
    participant Dev
    participant Workspace as pnpm-workspace.yaml
    participant PNPM as pnpm resolver
    participant Lock as pnpm-lock.yaml
    participant Registry as npm registry

    Dev->>Workspace: add/bump overrides + minimumReleaseAgeExclude
    Dev->>PNPM: pnpm install
    PNPM->>Workspace: read overrides & exclude list
    PNPM->>Registry: fetch patched versions
    Note over PNPM: bypass release-age gate for excluded pkgs
    PNPM->>Lock: write resolved graph (postcss 8.5.20, brace-expansion 5.0.8, ...)
    Lock-->>Dev: updated lockfile

tackley requested a review from a team as a code owner July 28, 2026 08:35

github-actions Bot added the puLL-Merge label Jul 28, 2026

tackley enabled auto-merge July 28, 2026 08:39

CodePeters approved these changes Jul 28, 2026

View reviewed changes

tackley added this pull request to the merge queue Jul 28, 2026

Merged via the queue into main with commit ff61e58 Jul 28, 2026
5 checks passed

tackley deleted the chore/audit-2026-07-28 branch July 28, 2026 09:09

Navigation Menu

Uh oh!

chore(audit): various upgrades - #206

chore(audit): various upgrades#206
tackley merged 1 commit into
mainfrom
chore/audit-2026-07-28

tackley commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

tackley commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Description

Possible Issues

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants