[teallarson]

Stacked on #166 — review and merge that one first. This PR only shows its own diff once #166 lands.

Clears the last pnpm audit finding that #166 deliberately left alone: fflate <0.8.3 (GHSA-px8p-9vwx-vf98, infinite loop parsing malformed ZIP64 archives), reachable only through @arethetypeswrong/core.

Why this needed its own PR

Overriding fflate under the old CLI doesn't work. @arethetypeswrong/core@0.17.x declares fflate: ^0.8.2, and forcing 0.8.3 under it makes attw --pack fail with:

error while checking file:
Cannot read properties of undefined (reading 'filename')

@arethetypeswrong/core@0.18.5 declares fflate: ^0.8.3 itself, so the patched version resolves naturally — no override entry needed. But it's a two-minor bump of the tool that gates the published type definitions, so it's worth verifying on its own rather than riding along with the override-only changes in #166.

Verification

The upgrade does not weaken the types check. attw --pack dist before and after analyzes the same 37 entrypoints and reports an identical problem set:

Problem kind	0.17.4	0.18.5
InternalResolutionError	240	240
CJSResolvesToESM	9	9
MissingExportEquals	1	1

All three are kinds scripts/utils/attw-report.cjs filters out by design, so Types ok! is a real pass, not a silent skip.

Also on a clean node_modules install:

• pnpm audit → no known vulnerabilities (down from 1 moderate on chore(deps): fix open Dependabot alerts via pnpm overrides #166, 6 on main)
• pnpm lint → eslint, build, tsc, attw, publint all pass
• pnpm test → 22 suites, 395 tests passing

🤖 Generated with Claude Code