From f4a46e1b2980ca6da2156f4a3ca36a14295c5828 Mon Sep 17 00:00:00 2001 From: Gabriel Taveira Date: Wed, 30 Sep 2026 09:12:36 -0300 Subject: [PATCH] chore(deps): bump undici and brace-expansion past advisories --- pnpm-lock.yaml | 31 ++++++++++++++++--------------- pnpm-workspace.yaml | 6 ++++-- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2d0b7f8..96ba9c1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -8,12 +8,13 @@ overrides: '@expo/plist>@xmldom/xmldom': 0.8.15 plist>@xmldom/xmldom: 0.9.12 '@typescript-eslint/typescript-estree>minimatch': 9.0.7 - brace-expansion@<1.1.18: ^1.1.18 - brace-expansion@>=4.0.0 <5.0.9: ^5.0.9 + brace-expansion@<1.1.21: ^1.1.21 + brace-expansion@>=4.0.0 <5.0.12: ^5.0.12 xcode>uuid: 11.1.1 js-yaml@<3.15.2: ^3.15.2 js-yaml@>=4.0.0 <4.3.2: ^4.3.2 ip-address@>=10.2.0 <10.5.1: ^10.5.1 + undici@>=7.0.0 <7.29.1: ^7.29.1 patchedDependencies: image-size@1.2.1: 47b9dd91145f35c3b5349ad9fb3775bac13fc02d305a711a31b69cf285982eef @@ -2217,11 +2218,11 @@ packages: resolution: {integrity: sha512-apC2+fspHGI3mMKj+dGevkGo/tCqVB8jMb6i+OX+E29p0Iposz07fABkRIfVUPNd5A5VbuOz1bZbnmkKLYF+wQ==} engines: {node: '>= 5.10.0'} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} + brace-expansion@1.1.21: + resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -5275,8 +5276,8 @@ packages: undici-types@7.18.2: resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==} - undici@7.29.0: - resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} + undici@7.29.1: + resolution: {integrity: sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==} engines: {node: '>=20.18.1'} unicode-canonical-property-names-ecmascript@2.0.1: @@ -8274,12 +8275,12 @@ snapshots: dependencies: big-integer: 1.6.52 - brace-expansion@1.1.18: + brace-expansion@1.1.21: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -10740,15 +10741,15 @@ snapshots: minimatch@10.2.5: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimatch@3.1.5: dependencies: - brace-expansion: 1.1.18 + brace-expansion: 1.1.21 minimatch@9.0.7: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -11392,7 +11393,7 @@ snapshots: proxy-agent: 8.0.2(supports-color@8.1.1) semver: 7.8.5 tinyglobby: 0.2.17 - undici: 7.29.0 + undici: 7.29.1 url-join: 5.0.0 wildcard-match: 5.1.4 transitivePeerDependencies: @@ -11978,7 +11979,7 @@ snapshots: undici-types@7.18.2: {} - undici@7.29.0: {} + undici@7.29.1: {} unicode-canonical-property-names-ecmascript@2.0.1: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8a7a829..0f6125d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -53,8 +53,8 @@ overrides: "@expo/plist>@xmldom/xmldom": 0.8.15 "plist>@xmldom/xmldom": 0.9.12 "@typescript-eslint/typescript-estree>minimatch": 9.0.7 - brace-expansion@<1.1.18: ^1.1.18 - brace-expansion@>=4.0.0 <5.0.9: ^5.0.9 + brace-expansion@<1.1.21: ^1.1.21 + brace-expansion@>=4.0.0 <5.0.12: ^5.0.12 xcode>uuid: 11.1.1 # GHSA-2883-xcg3-v3hh: maxTotalMergeKeys skips empty merge sources, so a # crafted YAML doc burns CPU. Dev-only (eslint, expo CLI, jest coverage), @@ -64,5 +64,7 @@ overrides: # GHSA NAT64 classifier gap (SSRF). Dev-only via release-it > proxy-agent > # socks, bumped per Dependabot alert #62. ip-address@>=10.2.0 <10.5.1: ^10.5.1 + # Dev-only (expo CLI, eslint, jest), bumped per Dependabot alerts #64-67, #70, #71. + undici@>=7.0.0 <7.29.1: ^7.29.1 patchedDependencies: image-size@1.2.1: patches/image-size@1.2.1.patch