Repository navigation
fix(deps): patch handlebars, http-cache-semantics and brace-expansion advisories - #187
Merged
Merged
Conversation
pluggy-github-app Bot
pushed a commit
that referenced
this pull request
Oct 8, 2026
# [0.92.0](v0.91.0...v0.92.0) (2026-10-08) ### Bug Fixes * **api:** URL-encode query string values ([#184](#184)) ([16f0596](16f0596)) * **deps:** patch handlebars, http-cache-semantics and brace-expansion advisories ([#187](#187)) ([0ef8d00](0ef8d00)) ### Features * add Smart Transfer linkedJourney, data consent and source account balance ([#186](#186)) ([c77e1c3](c77e1c3)) * **item:** add fetchItemsCursor and fetchAllItems for GET /v2/items ([#185](#185)) ([7a82811](7a82811)) * sync with the API spec (card metadata, SCR, merchants, category rules, pix-qr, boletos) ([#183](#183)) ([d0f0c86](d0f0c86))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
pnpm auditreports 14 advisories (2 critical, 8 high, 4 moderate), and the strict supply-chain audit inpreinstallblocks every install and release. The parents were updated first, and an override or exception was added only where a parent could not carry the fix.Changes
Parents bumped (
package.json, each version past the 14-dayminimumReleaseAge):jesteslinttypescript-eslint,@typescript-eslint/eslint-plugin,@typescript-eslint/parsersemantic-release@semantic-release/github@semantic-release/npm@semantic-release/release-notes-generator@semantic-release/gitstays on 10.0.1: 11.x requires Node^22.22.2 || >=24.15, and the only advisory on its path (braces) has no fix anyway.Advisories:
brace-expansion1.x / 2.x / 5.xminimatchnow resolves 2.1.7 and 5.0.12handlebarsconventional-changelog-writer's own range. It was published 2026-10-05, so it gets a time-boxedminimumReleaseAgeExcludeentry, to be removed after 2026-10-20http-cache-semanticsgot>cacheable-request's own range. It was published 2026-10-04, so it gets an exclude entry, to be removed after 2026-10-18.gotcannot move: 12+ is ESM-onlybracesauditConfig.ignoreGhsaswith the reason: it only reaches the release tooling, which expands our own glob patternsOverrides pruned. The new parents make
lodash,lodash-es,braces,micromatch,undici@6,undici@7and the threebrace-expansionpins redundant. Each one was dropped on its own, followed bypnpm update <pkg>and a cleanpnpm audit. Onlyjs-yamlstays: without it, the jest tree brings back 3.x. Apnpm dedupethen collapsed the duplicates the bumps left behind onto the newer copy; it introduced no new versions.allowBuilds. jest 30.5 brings in@parcel/watcher(throughjest-haste-map). pnpm 11 refuses a fresh install until its install script gets an explicit decision, so it is set tofalse. The script only compiles from source whennpm_config_build_from_source=true, and the platform binaries arrive throughoptionalDependencies.Checks
pnpm audit: 0 (1 ignored).pnpm audit signatures: 719 verified.pnpm install --frozen-lockfilefrom a cleannode_modules,pnpm test(21 suites / 90 tests),pnpm build,eslint .: all pass.got,jsonwebtoken) keep their versions.http-cache-semanticsonly changes in this repo's lockfile; consumers resolve it themselves.