fix(deps): resolve open high-severity Dependabot advisories (#1919)
* fix(deps): resolve open high-severity Dependabot advisories
Patch all fixable open high-severity Dependabot alerts.
Backend (go.mod):
- google.golang.org/grpc 1.82.0 -> 1.82.1 (GHSA-hrxh-6v49-42gf)
Frontend (pnpm overrides in apps/package.json) — all transitive:
- postcss -> ^8.5.12 (GHSA-6g55-p6wh-862q)
- fast-uri -> ^3.1.4 (GHSA-v2hh-gcrm-f6hx / -v39h / -q3j6 / -4c8g)
- sharp -> ^0.35.0 (GHSA-f88m-g3jw-g9cj)
- linkify-it -> ^5.0.2 (GHSA-v245-v573-v5vm / -22p9)
- js-yaml@4 -> ^4.3.0 (GHSA-52cp-r559-cp3m)
- adm-zip -> ^0.6.0 (GHSA-xcpc-8h2w-3j85)
- hono -> ^4.12.25 (GHSA-88fw / -q5qw / -3vhc / -f67f)
- @hono/node-server -> ^1.19.10 (GHSA-wc8c-qw6v-h7f6)
- ws -> ^8.21.0 (GHSA-96hv-2xvq-fx4p)
- lodash / lodash-es -> ^4.18.0 (GHSA-r5fr-rjxr-66jc)
- flatted -> ^3.4.2 (GHSA-rf6f / -25h7)
- @isaacs/brace-expansion -> ^5.0.1 (GHSA-7h2j-956f-4vf2)
- @modelcontextprotocol/sdk -> ^1.26.0 (GHSA-345p-7cg4-v4c7)
- brace-expansion@1 -> ^1.1.16, brace-expansion@2 -> ^2.1.2 (GHSA-3jxr)
- path-to-regexp@8 -> ^8.4.0 (GHSA-j3q9-mxjg-w52f)
- picomatch@2 -> ^2.3.2 (GHSA-c2c7-rcm5-vvqj)
- minimatch@3 -> ^3.1.4, @9 -> ^9.0.7, @10 -> ^10.2.3
(GHSA-7r86 / -23c5 / -3ppc)
Major-scoped override keys preserve each in-tree major line rather than
force a single version across incompatible consumers.
Not fixable here: github.com/docker/docker alerts (GHSA-x744-4wpc-v9h2,
GHSA-x86f-5xw2-fm2r, GHSA-rg2x-37c3-w2rh). No patched module version is
published — latest tag is v28.5.2+incompatible (the current pin) and two
of the three advisories have no fix yet.
Verified: backend build + vet clean; CLI 280 tests pass; web typecheck,
vite build, lint, and 6388 unit tests pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(web): regenerate license manifest after dependency bumps
---------
Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
João Salavisa
41a806b9dd