4grayandClaude Opus 5 d2316fafe9 fix(deps): patch transitive runtime CVEs via pnpm overrides ...

Closes 13 runtime-scope Dependabot advisories that Dependabot itself
cannot fix: the vulnerable packages are all transitive, so the bot has no
lever until each parent publishes a release widening its own pin.

Overrides added (pinned-source form, matching existing convention):

- @xmldom/xmldom 0.8.11 -> 0.8.13  (5 high) via video.js -> mpd-parser
- fast-uri       3.1.0  -> 3.1.4   (4 high) via electron-conf -> ajv
- js-yaml        4.1.1  -> 4.3.0   (2)      via electron-updater
- form-data      4.0.5  -> 4.0.6   (1 high) via axios
- ajv            8.17.1 -> 8.18.0  (1)      via electron-conf

Every target stays inside its parent's declared semver range. For xmldom,
fast-uri and js-yaml the newest published version is *outside* that range
(0.9.x / 4.x / 5.x), so "latest" would have broken them - the new doc
records that constraint.

Deliberately excluded:

- axios and uuid are direct deps already covered by open Dependabot PRs
  (#1251 bumps axios 1.16.0 -> 1.18.1; #1252 covers uuid). Hand-bumping
  them here would only conflict on the lockfile.
- undici (7 advisories) is labelled runtime scope but every path to it is
  build tooling - electron -> @electron/get, @angular/build, and
  @module-federation/dts-plugin. It is not in the packaged app.

Note on reachability: xmldom arrives via video.js -> VHS -> mpd-parser,
but the app routes every .mpd to Shaka, which uses its own DASH parser.
The code ships but is not on the playback path, so this is defence in
depth rather than closing a live hole. The genuinely reachable one is
js-yaml, which electron-updater uses to parse latest.yml from releases.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-07-25 22:25:38 +02:00

..

architecture

fix(deps): patch transitive runtime CVEs via pnpm overrides

2026-07-25 22:25:38 +02:00

superpowers

fix(stalker): preserve is_series episode metadata (#1218)

2026-07-21 07:51:37 +02:00