From c1c52731af30703c24f88dab93a48c053dc5e7d2 Mon Sep 17 00:00:00 2001 From: Gerard Oosterhof Date: Wed, 7 Oct 2026 15:22:41 +0200 Subject: [PATCH 1/2] fix(deps): source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q) source-map-js up to 1.2.1 allows an event-loop denial of service through indexed source-map section offsets (high). Lockfile-only, made with `npm update source-map-js --package-lock-only`; npm audit no longer reports it. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01SCdpT7UGfLM4PPM9GqUp1h --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 74e9165..a4306a1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7848,9 +7848,9 @@ } }, "node_modules/source-map-js": { - "version": "1.2.1", - "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz", - "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==", + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", "license": "BSD-3-Clause", "engines": { "node": ">=0.10.0" From 0e1feb32607dcbf350a384cd094d5eec3e97fcf6 Mon Sep 17 00:00:00 2001 From: Gerard Oosterhof Date: Wed, 7 Oct 2026 15:39:24 +0200 Subject: [PATCH 2/2] fix(deps): shell-quote 1.10.0 -> 1.12.0 (GHSA-pqg4-j6r4-53mv) shell-quote 1.8.4 to 1.10.0 lets `quote()` inject a command through a line terminator in a token after a `{ comment }` token (critical). It reaches the lockfile through @changesets/cli -> launch-editor, and CI's `npm audit --audit-level=high` fails on it for every PR. Lockfile-only, made with `npm update shell-quote --package-lock-only`; `npm audit` reports 0 vulnerabilities after. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01SCdpT7UGfLM4PPM9GqUp1h --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index a4306a1..3c2b387 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7674,9 +7674,9 @@ } }, "node_modules/shell-quote": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz", - "integrity": "sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==", + "version": "1.12.0", + "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz", + "integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==", "dev": true, "license": "MIT", "engines": {