deps: patch js-yaml and brace-expansion DoS advisories

.github/workflows/cli-ci.yml

@@ -31,7 +31,16 @@ jobs:
       run: |
         curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
           | tar -xz gitleaks
-        ./gitleaks git . --redact --verbose --no-banner
+        # --log-opts=HEAD scopes the scan to commits reachable from what's
+        # checked out: the whole history of this branch (or of the PR merge
+        # commit, i.e. base + PR commits), but NOT unrelated branches.
+        # `fetch-depth: 0` fetches refs/heads/* — every branch — and gitleaks
+        # otherwise scans all of them, so an open branch that legitimately
+        # commits a high-entropy value plus its own .gitleaks.toml allowlist
+        # would fail every OTHER branch's scan, which is judged against the
+        # allowlist at its own tip. Each branch is still fully scanned by its
+        # own PR, and pushes to dev/production scan their full history.
+        ./gitleaks git . --redact --verbose --no-banner --log-opts=HEAD
 
   lint-and-test:
     runs-on: ubuntu-latest

eslint.config.cjs

@@ -6,11 +6,9 @@
 
 const js = require('@eslint/js');
 const tseslint = require('typescript-eslint');
-// These plugins ship as ESM with a `default` export under CJS interop.
+// This plugin ships as ESM with a `default` export under CJS interop.
 const unicornPlugin =
   require('eslint-plugin-unicorn').default ?? require('eslint-plugin-unicorn');
-const importPlugin =
-  require('eslint-plugin-import').default ?? require('eslint-plugin-import');
 
 module.exports = tseslint.config(
   {
@@ -23,12 +21,15 @@ module.exports = tseslint.config(
   js.configs.recommended,
   ...tseslint.configs.recommended,
   {
-    // `unicorn` and `import` are only registered so legacy
+    // `unicorn` is only registered so legacy
     // `// eslint-disable-next-line unicorn/...` comments scattered through
-    // the source resolve. We don't enable any rules from them.
+    // the source resolve. We don't enable any rules from it.
+    // `eslint-plugin-import` used to be registered here for the same reason,
+    // but it was dropped: it dragged in minimatch@3 -> brace-expansion@1.x,
+    // which has an unpatched DoS advisory (GHSA-mh99-v99m-4gvg, no 1.x
+    // backport) and failed `pnpm audit`. No rules from it were ever enabled.
     plugins: {
       unicorn: unicornPlugin,
-      import: importPlugin,
     },
     languageOptions: {
       ecmaVersion: 2022,

package.json

@@ -11,7 +11,7 @@
     "bplist-parser": "^0.3.2",
     "chalk": "^5.6.2",
     "citty": "^0.2.2",
-    "js-yaml": "^5.0.0",
+    "js-yaml": "^5.2.2",
     "node-apk": "^1.2.1",
     "node-stream-zip": "^1.15.0",
     "plist": "^5.0.0",
@@ -31,7 +31,6 @@
     "chai": "^6.2.2",
     "eslint": "^10.5.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-unicorn": "^71.1.0",
     "husky": "^9.1.7",
     "mocha": "^11.7.6",
@@ -87,6 +86,7 @@
     "overrides": {
       "js-yaml@<3.14.2": ">=3.14.2",
       "js-yaml@>=4.0.0 <4.2.0": ">=4.2.0",
+      "js-yaml@>=5.0.0 <5.2.2": ">=5.2.2",
       "tar@<7.5.16": ">=7.5.16",
       "@isaacs/brace-expansion": ">=5.0.1",
       "fast-xml-parser": ">=5.5.7",
@@ -105,7 +105,7 @@
       "diff@>=6.0.0": "8.0.3",
       "brace-expansion@<1.1.16": "1.1.16",
       "brace-expansion@>=2.0.0 <2.0.3": "2.0.3",
-      "brace-expansion@>=3.0.0 <5.0.7": "5.0.7",
+      "brace-expansion@>=3.0.0 <5.0.8": "5.0.8",
       "ws@>=8.0.0 <8.21.0": "8.21.0",
       "esbuild@<0.28.1": ">=0.28.1",
       "micromatch>picomatch": "^2.3.2",