Fix all dependency security advisories (pnpm audit 33 → 0)

[mpsq]

Summary

Takes pnpm audit from 33 → 0 advisories by pinning every advisory-affected dependency to a patched version, in both all-dependency and production scope.

This branch is based on #220 (still open), so this PR contains the full set and reads as a single 33→0 change. Merging this supersedes the need to merge #220 separately; if #220 is preferred as the review unit, this branch can instead be merged into it.

What's included

From the earlier work (#220), advisories 33 → 20: overrides for immutable 3.8.3, lodash 4.18.1, tmp 0.2.7, ws 8.21.0; a rollup bump to ^3.30.0; and caret refreshes that pick up shell-quote 1.8.4 and fast-uri 3.1.2.

This change, advisories 20 → 0:

Advisory	Package	Severity	Fix
GHSA-2g4f-4pwh-qvx6	ajv (production)	moderate	dependency bump ^8.12.0 → ^8.18.0
GHSA-67mh-4wv8-2f99	esbuild (dev/build-time)	moderate	devDependency bump ^0.17.18 → ^0.25.0
GHSA-7h2j-956f-4vf2	@isaacs/brace-expansion	high	override 5.0.1
GHSA-f886-m6hf-6m8v	brace-expansion (1.x, 2.x)	moderate	overrides 1.1.13, 2.0.3
GHSA-mh29-5h37-fv8m	js-yaml (3.x, 4.x)	moderate	overrides 3.14.2, 4.1.1
GHSA-3ppc-4f35-3m26 / GHSA-7r86-cg39-jmmj / GHSA-23c5-xmqv-rm74	minimatch (3/4/9/10.x)	high	overrides 3.1.4, 4.2.5, 9.0.7, 10.2.3
GHSA-48c2-rrv3-qjmp	yaml (1.x)	moderate	override 1.10.3

The pnpm.overrides block now has 14 entries (the 4 from #220 + 10 here). The minimatch@10 and @isaacs/brace-expansion overrides are currently no-ops in the resolved tree (the patched minimatch versions no longer pull those vulnerable variants) — kept as defense against reintroduction.

Validation

• ✅ pnpm audit — no known vulnerabilities
• ✅ pnpm audit --prod — no known vulnerabilities
• ✅ pnpm install --frozen-lockfile — package.json and lockfile in sync
• ✅ pnpm build — passes (verified the esbuild 0.17 → 0.25 bump works through rollup-plugin-esbuild@5.0.0; dist output intact, no rollup-plugin-esbuild@6 bump needed)
• ✅ pnpm test — 34/34 pass
• ✅ pnpm codegen — produces no change attributable to this PR (see note)

Lockfile regenerated with pnpm install (pnpm 10, matching CI) — lockfileVersion: '9.0' unchanged.

Notes for reviewers

• esbuild bump (the one real compatibility risk): esbuild is only used build-time via rollup-plugin-esbuild; the dev server flagged by GHSA-67mh-4wv8-2f99 is never started, so the advisory isn't exploitable here — the bump is purely to clear the audit. Build + tests + dist output all confirmed clean on 0.25.
• codegen drift is upstream, not from this PR: running pnpm codegen regenerates src/graphql/types.ts and src/webhooks/webhook-schema.{json,ts} from the live Plain API, which has drifted since those snapshots were last committed (this is true on main/Fix dependency security vulnerabilities #220 as well). To prove the drift is unrelated to the dependency changes, codegen was run against both the new deps and the baseline Fix dependency security vulnerabilities #220 deps with the network held constant — the generated output was byte-for-byte identical (matching sha256) in both. Those regenerated files are intentionally not included here; this PR is dependency-only (package.json + pnpm-lock.yaml).

---

Note

Medium Risk
Direct esbuild major jump affects the Rollup build path; overrides broadly reshape the transitive tree though validation reportedly passed.

Overview
Clears pnpm audit by changing only package.json and pnpm-lock.yaml—no application source.

Direct version bumps: production ajv to ^8.18.0; dev esbuild ^0.25.0 and rollup ^3.30.0 (build toolchain). The lockfile refreshes transitive picks (e.g. lodash, js-yaml, minimatch, ws, tmp, immutable, yaml).

New pnpm.overrides: fourteen pinned versions for advisory-affected transitives (immutable, lodash, tmp, ws, @isaacs/brace-expansion, brace-expansion 1/2, js-yaml 3/4, minimatch 3/4/9/10, yaml@1), including some defensive pins that may not currently appear in the resolved tree.

esbuild 0.17 → 0.25 is the main compatibility surface (used via rollup-plugin-esbuild at build time); PR description notes build/tests were verified.

^{Reviewed by Cursor Bugbot for commit 6a07e7c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	esbuild@​0.25.12
	ajv@​8.20.0
	rollup@​3.30.0

View full report