From b3802932a966684b06c8c3722d777eb5204cfff0 Mon Sep 17 00:00:00 2001 From: Hanssen0-Alter-Ego <343111139+Hanssen0-Alter-Ego@users.noreply.github.com> Date: Sun, 18 Oct 2026 02:36:06 +0800 Subject: [PATCH 1/3] fix(deps): refresh public transitive security dependencies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Keep the minimatch override scoped to the legacy TypeScript ESLint consumer. Preserve existing majors and refresh the lockfile entries for bn.js, minimatch, and brace-expansion. Generated by ChatGPT · Alter Ego --- .changeset/public-transitive-security.md | 4 ++ pnpm-lock.yaml | 50 ++++++------------------ pnpm-workspace.yaml | 4 ++ 3 files changed, 19 insertions(+), 39 deletions(-) create mode 100644 .changeset/public-transitive-security.md diff --git a/.changeset/public-transitive-security.md b/.changeset/public-transitive-security.md new file mode 100644 index 000000000..13a5c2d17 --- /dev/null +++ b/.changeset/public-transitive-security.md @@ -0,0 +1,4 @@ +--- +--- + +Refresh vulnerable transitive bn.js, minimatch, and brace-expansion lockfile entries within their existing major versions. Limit the minimatch override to the legacy TypeScript ESLint consumer. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ba01f596f..ad8dd1d8d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,9 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + '@typescript-eslint/typescript-estree@6.21.0>minimatch': 9.0.9 + importers: .: @@ -5723,16 +5726,13 @@ packages: blake2b@2.1.4: resolution: {integrity: sha512-AyBuuJNI64gIvwx13qiICz6H6hpmjvYS5DGkG6jbXMOT8Z3WUJ3V1X0FlhIoT1b/5JtHE3ki+xjtMvu1nn+t9A==} - bn.js@4.12.2: - resolution: {integrity: sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==} + bn.js@4.12.3: + resolution: {integrity: sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==} body-parser@2.3.0: resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} engines: {node: '>=18'} - brace-expansion@1.1.12: - resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==} - brace-expansion@1.1.21: resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} @@ -5743,10 +5743,6 @@ packages: resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} - braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} engines: {node: '>=8'} @@ -8617,16 +8613,9 @@ packages: resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.2: - resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==} - minimatch@3.1.5: resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minimatch@9.0.3: - resolution: {integrity: sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==} - engines: {node: '>=16 || 14 >=14.17'} - minimatch@9.0.9: resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==} engines: {node: '>=16 || 14 >=14.17'} @@ -14406,7 +14395,7 @@ snapshots: debug: 4.4.3 globby: 11.1.0 is-glob: 4.0.3 - minimatch: 9.0.3 + minimatch: 9.0.9 semver: 7.8.5 ts-api-utils: 1.4.3(@typescript/typescript6@6.0.2) optionalDependencies: @@ -15214,7 +15203,7 @@ snapshots: blake2b-wasm: 2.4.0 nanoassert: 2.0.0 - bn.js@4.12.2: {} + bn.js@4.12.3: {} body-parser@2.3.0: dependencies: @@ -15230,11 +15219,6 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@1.1.12: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 @@ -15248,10 +15232,6 @@ snapshots: dependencies: balanced-match: 4.0.4 - brace-expansion@5.0.7: - dependencies: - balanced-match: 4.0.4 - braces@3.0.3: dependencies: fill-range: 7.1.1 @@ -15532,7 +15512,7 @@ snapshots: copyfiles@2.4.1: dependencies: glob: 7.2.3 - minimatch: 3.1.2 + minimatch: 3.1.5 mkdirp: 1.0.4 noms: 0.0.0 through2: 2.0.5 @@ -15951,7 +15931,7 @@ snapshots: elliptic@6.6.1: dependencies: - bn.js: 4.12.2 + bn.js: 4.12.3 brorand: 1.1.0 hash.js: 1.1.7 hmac-drbg: 1.0.1 @@ -17145,7 +17125,7 @@ snapshots: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.2 + minimatch: 3.1.5 once: 1.4.0 path-is-absolute: 1.0.1 @@ -19184,24 +19164,16 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.12 minimatch@10.2.6: dependencies: brace-expansion: 5.0.12 - minimatch@3.1.2: - dependencies: - brace-expansion: 1.1.12 - minimatch@3.1.5: dependencies: brace-expansion: 1.1.21 - minimatch@9.0.3: - dependencies: - brace-expansion: 2.1.7 - minimatch@9.0.9: dependencies: brace-expansion: 2.1.7 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fba67cac3..d3b4c85b1 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,3 +12,7 @@ allowBuilds: secp256k1: true sharp: true unrs-resolver: true +overrides: + # typedoc-plugin-ga's legacy ESLint chain pins minimatch 9.0.3 exactly. + # Keep this CommonJS consumer on its existing major with the security fixes. + '@typescript-eslint/typescript-estree@6.21.0>minimatch': 9.0.9 From 0c769893860628248cdcd05bdfd02b5fd977805f Mon Sep 17 00:00:00 2001 From: Hanssen's Alter Ego Date: Sun, 18 Oct 2026 02:59:57 +0800 Subject: [PATCH 2/3] fix(deps): remove scoped minimatch override MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Retain ordinary compatible dependency updates and restore the legacy exact-pinned minimatch dependency unchanged. Generated by ChatGPT · Alter Ego --- .changeset/public-transitive-security.md | 2 +- pnpm-lock.yaml | 13 +++++++++---- pnpm-workspace.yaml | 4 ---- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.changeset/public-transitive-security.md b/.changeset/public-transitive-security.md index 13a5c2d17..9094f4c20 100644 --- a/.changeset/public-transitive-security.md +++ b/.changeset/public-transitive-security.md @@ -1,4 +1,4 @@ --- --- -Refresh vulnerable transitive bn.js, minimatch, and brace-expansion lockfile entries within their existing major versions. Limit the minimatch override to the legacy TypeScript ESLint consumer. +Refresh compatible transitive bn.js, minimatch, and brace-expansion lockfile entries within their existing major versions. Leave exact-pinned dependencies unchanged. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index ad8dd1d8d..f54e28c7a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,9 +4,6 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false -overrides: - '@typescript-eslint/typescript-estree@6.21.0>minimatch': 9.0.9 - importers: .: @@ -8616,6 +8613,10 @@ packages: minimatch@3.1.5: resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} + minimatch@9.0.3: + resolution: {integrity: sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==} + engines: {node: '>=16 || 14 >=14.17'} + minimatch@9.0.9: resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==} engines: {node: '>=16 || 14 >=14.17'} @@ -14395,7 +14396,7 @@ snapshots: debug: 4.4.3 globby: 11.1.0 is-glob: 4.0.3 - minimatch: 9.0.9 + minimatch: 9.0.3 semver: 7.8.5 ts-api-utils: 1.4.3(@typescript/typescript6@6.0.2) optionalDependencies: @@ -19174,6 +19175,10 @@ snapshots: dependencies: brace-expansion: 1.1.21 + minimatch@9.0.3: + dependencies: + brace-expansion: 2.1.7 + minimatch@9.0.9: dependencies: brace-expansion: 2.1.7 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index d3b4c85b1..fba67cac3 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,7 +12,3 @@ allowBuilds: secp256k1: true sharp: true unrs-resolver: true -overrides: - # typedoc-plugin-ga's legacy ESLint chain pins minimatch 9.0.3 exactly. - # Keep this CommonJS consumer on its existing major with the security fixes. - '@typescript-eslint/typescript-estree@6.21.0>minimatch': 9.0.9 From 3df275eac0eff3430afc5b1d7df4423ebb1d7299 Mon Sep 17 00:00:00 2001 From: Hanssen's Alter Ego Date: Sun, 18 Oct 2026 03:23:31 +0800 Subject: [PATCH 3/3] chore: remove empty security-update changeset --- .changeset/public-transitive-security.md | 4 ---- 1 file changed, 4 deletions(-) delete mode 100644 .changeset/public-transitive-security.md diff --git a/.changeset/public-transitive-security.md b/.changeset/public-transitive-security.md deleted file mode 100644 index 9094f4c20..000000000 --- a/.changeset/public-transitive-security.md +++ /dev/null @@ -1,4 +0,0 @@ ---- ---- - -Refresh compatible transitive bn.js, minimatch, and brace-expansion lockfile entries within their existing major versions. Leave exact-pinned dependencies unchanged.