fix(deps): resolve open dependabot security alerts

.changeset/dependabot-security-alerts.md

@@ -0,0 +1,7 @@
+---
+"nostream": patch
+---
+
+fix(deps): resolve open dependabot security alerts
+
+Bumps axios to ^1.20.0, stream-json to ^3.7.0 (with the v3 ESM import-shape fix in the event import service) and js-yaml to 4.3.2, and adds pnpm overrides forcing proxy-addr >= 2.0.8, fast-uri >= 3.1.7, brace-expansion >= 1.1.21 <2 / >= 2.1.7 <3 and js-yaml 3.x >= 3.15.2 <4. The hero-animation package stubs its unfixable transitive ip <= 2.0.1 (werift chain, unused at runtime) with @stdlib/utils-noop.

.github/workflows/deploy-website.yml

@@ -18,9 +18,11 @@ concurrency:
 
 jobs:
   deploy:
+    # workflow_dispatch ignores every on: filter — a manual run must not
+    # publish a non-main branch to production, so dispatch stays main-only.
     if: >-
       ${{ startsWith(github.event.release.tag_name, 'nostream-website@') ||
-      github.event_name == 'workflow_dispatch' }}
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
     name: Build and deploy to Cloudflare Workers
     runs-on: ubuntu-latest
     # Deploy credentials live in this GitHub environment: CLOUDFLARE_API_TOKEN

package.json

@@ -175,19 +175,19 @@
     "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
     "@opentelemetry/resources": "^2.8.0",
     "@opentelemetry/sdk-metrics": "^2.8.0",
-    "axios": "^1.18.0",
+    "axios": "^1.20.0",
     "cac": "^7.0.0",
     "colorette": "^2.0.20",
     "express": "4.22.1",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.2",
     "knex": "2.4.2",
     "ora": "^9.3.0",
     "pg": "8.9.0",
     "pg-query-stream": "4.3.0",
     "pino": "^8.21.0",
     "ramda": "0.28.0",
     "redis": "4.5.1",
-    "stream-json": "^2.1.0",
+    "stream-json": "^3.7.0",
     "ws": "^8.21.0",
     "zod": "^3.22.4"
   },
@@ -196,7 +196,12 @@
   },
   "pnpm": {
     "overrides": {
-      "serialize-javascript": ">=7.0.3 <8"
+      "serialize-javascript": ">=7.0.3 <8",
+      "proxy-addr@<2.0.8": ">=2.0.8",
+      "fast-uri@<3.1.7": ">=3.1.7",
+      "brace-expansion@<1.1.21": ">=1.1.21 <2",
+      "brace-expansion@>=2.0.0 <2.1.7": ">=2.1.7 <3",
+      "js-yaml@>=3.0.0 <3.15.2": ">=3.15.2 <4"
     }
   }
 }

src/services/event-import-service.ts

@@ -1,9 +1,10 @@
 import fs from 'fs'
 import readline from 'readline'
 
-const streamArray = require('stream-json/streamers/stream-array.js') as {
-  withParserAsStream: () => NodeJS.ReadWriteStream
+const streamArrayModule = require('stream-json/streamers/stream-array.js') as {
+  default: { withParserAsStream: () => NodeJS.ReadWriteStream }
 }
+const streamArray = streamArrayModule.default
 
 import {
   getEventExpiration,

website/hero-animation/package.json

@@ -31,6 +31,9 @@
     "typescript": "^5.8.3"
   },
   "pnpm": {
+    "overrides": {
+      "ip@<=2.0.1": "npm:@stdlib/utils-noop@^0.2.3"
+    },
     "onlyBuiltDependencies": [
       "esbuild",
       "node-av",