[PAMulligan]

Description

Dependabot's security updates have failed on every run since 2026-10-06. The original blocker (source-map-js) cleared with the vite bump; the runs now fail on minimatch, whose newest advisory is fixed only in 11.0.1 (security_update_not_possible, latest resolvable 3.1.5). 26 alerts were open when this started: 1 critical, 13 high, 10 medium, 2 low.

This pins every fix that is reachable without a major jump through pnpm.overrides in the root package.json, each scoped to its major (the js-yaml@3 form only applies where the parent's declared range is inside that major), and moves the pipeline package's own zod to 4.6.6+. The lockfile diff is exactly these version moves; nothing else re-resolved.

Package	Was	Now	Alerts closed	Parents (declared range)
proxy-addr	2.0.7	2.0.8	critical #134	express 4 (~2.0.7)
compression	1.8.1	1.8.2	high #135	@lhci/cli (^1.7.4)
js-yaml 3.x and 4.x	3.15.1, 4.3.1	3.15.2, 4.3.2	high #114, #115	@lhci/utils (^3.13.1); cosmiconfig, builder-util, @eslint/eslintrc (^4.x)
fast-uri	3.1.6	3.1.9	high #116, #141; medium #161, #166; low #164, #165	ajv 8 (^3.0.1)
brace-expansion 1, 2, 5	1.1.18, 2.1.4, 5.0.9	1.1.21, 2.1.7, 5.0.12	high #129, #131, #133, #143; medium #132, #138, #145	minimatch 3, 5, 9, 10
ip-address	10.5.0	10.7.5	medium #118, #128, #140	socks (^10.1.1)
qs	6.15.3	6.17.1	medium #167	express, body-parser (~6.15.1)
body-parser	1.20.6	1.20.9	pnpm audit only	express (~1.20.5)
zod under eslint-plugin-react-hooks	4.4.3	4.6.7	part of #160	declared ^3.25.0 || ^4.0.0, so this one uses the parent-scoped eslint-plugin-react-hooks>zod form
zod in packages/pipeline (direct)	3.25.76	4.6.7	high #155	packages/pipeline/package.json; zod 4.6.7 still accepts the single-argument z.record() the IR schema uses, and the 133 pipeline tests pass

Related Issue

Refs #169. It stays open: two alerts remain that this PR deliberately does not force (see below), and the Dependabot run will stay red until they are fixed or dismissed.

Type of Change

• Bug fix
• New feature
• Documentation update
• Chore
• Breaking change

Decisions left to you

1. zod 3.23.8 under chromium-bidi 0.6.3 (alert chore(deps-dev): bump electron from 39.8.5 to 39.8.10 #160, high, the lockfile copy). chromium-bidi pins zod: 3.23.8 exactly, under puppeteer-core 22, lighthouse 12, @lhci/cli 0.14. The parent path is @lhci/cli 0.16.0 (lighthouse 13.6, puppeteer-core 25, chromium-bidi 157 on zod ^4.6.5): a Lighthouse major that will move the scores the Lighthouse CI gates assert, so it wants its own PR with an e2e run on the isolated stack. The alternative is dismissing chore(deps-dev): bump electron from 39.8.5 to 39.8.10 #160 as tolerable risk: dev-only, and Lighthouse drives Chrome over CDP, so the BiDi module that imports zod is never loaded.

2. minimatch below 11.0.1 (alert deps: Dependabot security updates fail on every run (source-map-js); 1 critical alert open #169, medium, "potential denial of service via globparts amplification", published 2026-10-30, no backports). The only fix forces minimatch 11 onto glob 7 (electron-builder's asar packaging), eslint 9 and typescript-eslint, which is the major jump the issue's brace-expansion rule avoids. This is the alert the Dependabot run currently fails on. Dismissing it as tolerable risk (dev tooling; patterns come from our own config) keeps the run green until the parents move.

3. extract-zip (alerts Packaging, distribution & documentation #106, ci: enforce WordPress Coding Standards (PHPCS) on pull requests #113, high, no fixed release). Reached only through @lhci/cli, lighthouse, puppeteer-core, @puppeteer/browsers, where it unpacks browser downloads; nothing ships to production from it (the GUI bundle carries only out/** and react). The issue says to dismiss these with a note. I tried from the session and the permission classifier blocked the API write, so:

   for n in 106 113; do gh api -X PATCH repos/PMDevSolutions/Flavian/dependabot/alerts/$n -f state=dismissed -f dismissed_reason=tolerable_risk -f dismissed_comment="No fixed release. Dev-only, reached through @lhci/cli (lighthouse, puppeteer-core, @puppeteer/browsers) to unpack browser downloads; nothing ships to production from it. Revisit when a fix is published or @lhci/cli moves to 0.16+. See #169."; done

4. sprintf-js no longer has an open alert. basic-ftp (pnpm audit only) is fixed in 6.2.1 while get-uri declares ^5; left alone for the same reason as 2.

After merging, trigger Dependabot from Insights, Dependency graph, Dependabot, "Check for updates", rather than waiting for the schedule.

Verification

• pnpm audit: 39 findings before (1 critical, 18 high, 18 moderate, 2 low), 8 after: extract-zip x2 (no fix), zod 3.23.8, minimatch, basic-ftp. No critical or high with a reachable fix remains.
• ./scripts/security-audit/scan-dependencies.sh . (what the Security Audit workflow gates on) exits 0.
• pnpm --filter @flavian/gui lint, typecheck, test (55), pnpm test:pipeline (133), pnpm test:claude (88), pnpm lint:commits.
• pnpm --filter @flavian/gui build && pnpm --filter @flavian/gui smoke on macOS: "GUI launched and reached the setup view". Note for anyone running it from a VS Code terminal: the extension host exports ELECTRON_RUN_AS_NODE=1, which makes the Electron binary run as plain Node and Playwright report "Process failed to launch"; unset it first.
• pnpm test:init: 69 of 71, the same two Canva export failures as on main on macOS (scripts/canva-fse, untouched here, green in CI on Ubuntu).

Checklist

• Tests pass (see above)
• Commit follows Conventional Commits (fix(deps), so release-please cuts a patch release with a changelog entry)
• PHPCS and security scan: no PHP changed
• Docker environment: not affected
• Documentation: not needed

This branch is stacked on #182 (the two lockfile changes touch adjacent js-yaml lines); merge either first, the other rebases cleanly.

🤖 Generated with Claude Code