chore(deps): consolidate all dependency updates and fix OSV-Scanner CI failure by camcima · Pull Request #42 · camcima/finita

camcima · 2026-07-31T02:38:05Z

Consolidates all six open Dependabot PRs into a single change, and fixes the OSV-Scanner failure that was blocking CI on every branch.

Why CI was red

OSV-Scanner was failing identically on every branch and on scheduled runs of main — 16 advisories across 6 dev-only transitive packages pinned in pnpm-lock.yaml. It was never caused by any individual PR; every branch simply inherited the lockfile from main.

Five of the six were already cleared on this branch. The last one was nanoid.

Note: the scanner's FIXED VERSION column reported 3.3.17 for nanoid, but the OSV API affected range for GHSA-2v37-7h3g-55p8 is [0, 3.3.18) — so 3.3.17 would still have been vulnerable. Pinned to 3.3.18.

Likewise brace-expansion@2.1.4 was flagged on an earlier run, but the current advisory range is <2.1.3; that was stale advisory data and needed no change.

Dependency updates folded in

PR	Update
#36	`@types/node` 25.9.1 → 26.x
#40	`actions/setup-node` v6 → v7
#41	dev-dependencies group, 8 updates
#43	`pnpm/action-setup` v6 → v6.0.9
#44	`github/codeql-action` v4 → v4.37.4
#45	`google/osv-scanner-action` v2.3.8 → v2.5.0

Security

nanoid 3.3.16 → 3.3.18 — GHSA-2v37-7h3g-55p8

nanoid is a dev-only transitive dep (postcss → nanoid). finita ships zero runtime dependencies; the published package contains dist/ only.

Verification

Run locally against the full CI command set:

pnpm run format:check — pass
pnpm run lint — pass (tsc --noEmit, test tsconfig, eslint)
pnpm test — 369 passed / 46 files
pnpm run build && npm pack --dry-run — pass
OSV: every package in pnpm-lock.yaml re-queried against the OSV API, honouring osv-scanner.toml ignores — clean, no unfiltered advisories

Closes #36, closes #40, closes #41, closes #43, closes #44, closes #45

Merges the three open Dependabot PRs into one verified update: - @types/node ^25.9.1 -> ^26.0.1 (major, #36) - actions/setup-node v6 -> v7 (#40) - Lockfile-only refresh of @commitlint/cli 21.2.1, @commitlint/config-conventional 21.2.0, @vitest/coverage-v8 3.2.7, eslint 10.8.0, lefthook 2.1.10, prettier 3.9.6, typescript-eslint 8.65.0, vitest 3.2.7 (#41) typescript stays pinned at 6.0.3: tsup's rollup-plugin-dts and typescript-eslint both hard-block TypeScript 7 today. Reformatted tests/selector.test.ts to match prettier 3.9.6's updated union-type line-wrapping. Closes #36, #40, #41 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

codecov · 2026-07-31T02:38:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (c2bd2db) to head (35ce773).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #42   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           61        61           
  Lines         1801      1801           
  Branches       268       268           
=========================================
  Hits          1801      1801

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Re-resolved pnpm-lock.yaml against the existing package.json specifiers (pnpm update --depth Infinity, then package.json reverted, then pnpm install --lockfile-only) so already-patched transitive versions that satisfy parent packages' semver ranges get picked up. pnpm normally preserves existing lockfile resolutions on install, so these patched versions were available but never selected. No manifest changes, no pnpm.overrides added, no scanner suppressions. pnpm audit --audit-level=high: before: 13 vulnerabilities (8 high, 2 moderate, 3 low) after: 2 vulnerabilities (1 high, 1 low) Cleared: - 7x undici advisories (release-it@20.2.0 -> undici 8.3.0 -> 8.9.0, now >=8.5.0): GHSA-vmh5-mc38-953g, GHSA-38rv-x7px-6hhq, GHSA-vxpw-j846-p89q, GHSA-p88m-4jfj-68fv, GHSA-pr7r-676h-xcf6, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m - brace-expansion GHSA-3jxr-9vmj-r5cp (both eslint and vitest coverage paths, resolved to 2.1.4 / 5.0.9) - postcss GHSA-r28c-9q8g-f849 (vitest -> vite -> postcss 8.5.15 -> 8.5.25) Remain (semver ceilings a lockfile refresh cannot cross; verified via node_modules package.json dependency ranges): - brace-expansion GHSA-mh99-v99m-4gvg (high): needs >=5.0.8, but @vitest/coverage-v8 -> test-exclude -> glob@10.5.0 pins minimatch@^9.0.4, which pins brace-expansion@^2.0.2 (max 2.x). - esbuild GHSA-g7r4-m6w7-qqqr (low): needs >=0.28.1, but tsup@8.5.1 pins esbuild@^0.27.0 directly and via bundle-require. typescript confirmed to stay at 6.0.3. Verified: pnpm install --frozen-lockfile succeeds, build/lint pass, and all 369 tests (46 files) still pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

camcima · 2026-07-31T09:36:40Z

Transitive dependency refresh (lockfile-only)

Unparked this PR by re-resolving pnpm-lock.yaml against the existing, unchanged package.json specifiers, using the verified recipe:

pnpm update --depth Infinity     # refreshes transitives, also rewrites package.json specifiers
git checkout -- package.json     # revert manifest rewrites — lockfile-only
pnpm install --lockfile-only     # re-resolve lockfile against original specifiers

Most transitive advisories were already patched upstream and satisfied the parent packages' existing semver ranges — they just hadn't been picked up because pnpm install preserves existing lockfile resolutions once a package is first added. This refresh forces re-resolution without touching any manifest ranges.

No pnpm.overrides added, no scanner suppressions, no hand-pinned transitives, osv-scanner.toml untouched.

`pnpm audit --audit-level=high`

	Total	High	Moderate	Low
Before	13	8	2	3
After	2	1	0	1

Cleared (11 advisories)

7x undici (via release-it@20.2.0 → undici@8.3.0 → now 8.9.0, ≥8.5.0 required): GHSA-vmh5-mc38-953g, GHSA-38rv-x7px-6hhq, GHSA-vxpw-j846-p89q, GHSA-p88m-4jfj-68fv, GHSA-pr7r-676h-xcf6, GHSA-35p6-xmwp-9g52, GHSA-g8m3-5g58-fq7m
brace-expansion GHSA-3jxr-9vmj-r5cp — both instances (via @eslint/js→eslint→config-array→minimatch and via @vitest/coverage-v8→test-exclude), now resolving to 2.1.4/5.0.9
postcss GHSA-r28c-9q8g-f849 (via vitest→vite), now 8.5.25 (≥8.5.18 required)

Remain (2 advisories — genuine semver ceilings, not fixable by lockfile refresh)

brace-expansion GHSA-mh99-v99m-4gvg (high) — fix requires ≥5.0.8. Path: @vitest/coverage-v8 → test-exclude → glob@10.5.0 → minimatch@^9.0.4 → brace-expansion@^2.0.2. glob@10.5.0's own manifest caps minimatch at ^9.0.4, and minimatch@9.0.9 caps brace-expansion at ^2.0.2 — the fix landed in the 5.x major line, unreachable without glob/minimatch themselves bumping majors.
esbuild GHSA-g7r4-m6w7-qqqr (low) — fix requires ≥0.28.1. Path: tsup@8.5.1 → esbuild@^0.27.0 (direct, and also via bundle-require). tsup@8.5.1's manifest caps esbuild at ^0.27.0, so 0.28.1 is unreachable without a tsup bump.

Both would need a direct-dependency bump (vitest's coverage chain / tsup) to clear — out of scope for this lockfile-only refresh.

Also checked per the parking note, not resolvable here

release-it stays at 20.2.0 as required (not bumped to 21.x). All 7 undici advisories tied to it are already clear via the transitive resolution above, so no major bump was needed for those.
Looked for the tar advisories via release-it-pnpm→changelogithub→changelogen→c12→giget→tar mentioned when this was parked: in the current tree, release-it@20.2.0's only relevant chain is release-it → c12@3.3.3 → giget@2.0.0, and giget@2.0.0 does not depend on tar at all (no tar package appears anywhere in pnpm-lock.yaml or node_modules). No release-it-pnpm, changelogithub, or changelogen packages are present either. pnpm audit shows no tar-related findings before or after. Flagging the discrepancy in case that context was from a different snapshot — happy to double check if there's a reason to expect tar in the tree.

Verification

typescript confirmed to stay at 6.0.3 (pnpm ls typescript)
pnpm install --frozen-lockfile — succeeds
pnpm run build — succeeds (ESM/CJS/DTS all build cleanly)
pnpm run lint — clean (tsc + eslint)
pnpm test — 369/369 tests passing (46 files), same count as before

Commit: 49e33ba — lockfile-only change (package.json untouched, verified via diff and checksum).

Not merging — leaving this for review/merge as usual.

Consolidates the last three open Dependabot PRs into this branch and fixes the OSV-Scanner failure that was blocking CI on every branch, including scheduled runs on main. GitHub Actions bumps: - pnpm/action-setup v6 -> v6.0.9 (#43) - github/codeql-action v4 -> v4.37.4 (#44) - google/osv-scanner-action v2.3.8 -> v2.5.0 (#45) Security: - nanoid 3.3.16 -> 3.3.18, resolving GHSA-2v37-7h3g-55p8. The advisory is fixed in 3.3.18; the scanner's reported "fixed version" of 3.3.17 is inaccurate, confirmed against the OSV API affected ranges. nanoid is a transitive dev-only dep (postcss > nanoid) and is not shipped in the published package, which contains dist/ only. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018S1GGSmwCaX4Nvg9WgUC4a

Copilot AI review requested due to automatic review settings July 31, 2026 02:38

Copilot AI reviewed Jul 31, 2026

camcima changed the title ~~chore: combine 3 dependency updates~~ chore(deps): consolidate all dependency updates and fix OSV-Scanner CI failure Aug 16, 2026

camcima merged commit c84435d into main Aug 16, 2026
8 checks passed

camcima deleted the chore/combined-dependency-updates branch August 16, 2026 23:32

Navigation Menu

chore(deps): consolidate all dependency updates and fix OSV-Scanner CI failure - #42

chore(deps): consolidate all dependency updates and fix OSV-Scanner CI failure#42
camcima merged 3 commits into
mainfrom
chore/combined-dependency-updates

camcima commented Jul 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

codecov Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

camcima commented Jul 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

camcima commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why CI was red

Dependency updates folded in

Security

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

camcima commented Jul 31, 2026

Transitive dependency refresh (lockfile-only)

pnpm audit --audit-level=high

Cleared (11 advisories)

Remain (2 advisories — genuine semver ceilings, not fixable by lockfile refresh)

Also checked per the parking note, not resolvable here

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

camcima commented Jul 31, 2026 •

edited

Loading

codecov Bot commented Jul 31, 2026 •

edited

Loading

`pnpm audit --audit-level=high`