From eaa40e647a87eb8140da57981f75bd04f0e981e1 Mon Sep 17 00:00:00 2001 From: "devin-ai-integration[bot]" <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 19:59:55 +0000 Subject: [PATCH] chore(deps): fix nanoid, tmp, vitest advisories - vitest 4.1.10 -> 4.1.11 (GHSA-82fw-gwwq-j7x9) - nanoid 3.3.16 -> 3.3.18, lockfile-only (GHSA-2v37-7h3g-55p8) - playground: solc 0.8.36 -> 0.8.37 (lockfile-only) and tmp override ^0.2.7 (GHSA-ph9p-34f9-6g65, GHSA-52f5-9888-hmc6; 0.2.7 also fixes GHSA-7c78-jf6q-g5cm) Refs APPS-1643 Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- package.json | 2 +- playground/pnpm-lock.yaml | 35 +++++------ playground/pnpm-workspace.yaml | 2 + pnpm-lock.yaml | 102 ++++++++++++++++----------------- 4 files changed, 68 insertions(+), 73 deletions(-) diff --git a/package.json b/package.json index 247494b..de20ead 100644 --- a/package.json +++ b/package.json @@ -113,7 +113,7 @@ "viem": "2.55.10", "vite": "^7.3.6", "vite-node": "^6.0.0", - "vitest": "4.1.10" + "vitest": "4.1.11" }, "packageManager": "pnpm@11.20.0" } diff --git a/playground/pnpm-lock.yaml b/playground/pnpm-lock.yaml index b0243de..04516aa 100644 --- a/playground/pnpm-lock.yaml +++ b/playground/pnpm-lock.yaml @@ -8,6 +8,7 @@ overrides: vite: ^7.3.6 postcss: ^8.5.24 picomatch: ^4.0.5 + tmp: ^0.2.7 pnpmfileChecksum: sha256-tXtEEZojFeMJabYIsm28vIcyprmmTtAAJjyDjyGe924= @@ -81,10 +82,10 @@ importers: version: 19.3.0(@types/react@19.3.0) solc: specifier: ^0.8.36 - version: 0.8.36 + version: 0.8.37 soltag: specifier: ^0.0.17 - version: 0.0.17(esbuild@0.28.2)(rollup@4.63.1)(solc@0.8.36)(viem@2.55.10(typescript@7.0.2))(vite@7.3.6(@types/node@25.2.0)) + version: 0.0.17(esbuild@0.28.2)(rollup@4.63.1)(solc@0.8.37)(viem@2.55.10(typescript@7.0.2))(vite@7.3.6(@types/node@25.2.0)) typescript: specifier: 7.0.2 version: 7.0.2 @@ -1444,10 +1445,6 @@ packages: engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true - os-tmpdir@1.0.2: - resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==} - engines: {node: '>=0.10.0'} - ox@0.14.33: resolution: {integrity: sha512-rooA/4o7bBof4Ge2VH/eovfNPb/AEEYyrNj03wggc55g5HZD8Pjs/OeWhttgjic3dDcqn0r29bDuvQEdTiUemQ==} peerDependencies: @@ -1542,8 +1539,8 @@ packages: resolution: {integrity: sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==} hasBin: true - solc@0.8.36: - resolution: {integrity: sha512-cnDhjWo8dC5FxnEwCrWxUsJS7RPsHf+pVUe9Tr/+b15sQ40WCVn4vX4R+tOvN5gRfEgiquvFzfF4VV0kSnknhw==} + solc@0.8.37: + resolution: {integrity: sha512-ieUYdPDRGNKMsZpCfi9tY64Q+ASoL8tyhLuvf9cFiqDs+6ijlx8Wn2CRi0N71AlCvRx0V092rlUYu3b3PuxWlA==} engines: {node: '>=12.0.0'} hasBin: true @@ -1571,9 +1568,9 @@ packages: resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==} engines: {node: '>=12.0.0'} - tmp@0.0.33: - resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==} - engines: {node: '>=0.6.0'} + tmp@0.2.7: + resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==} + engines: {node: '>=14.14'} tslib@2.8.1: resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==} @@ -2941,8 +2938,6 @@ snapshots: nanoid@3.3.18: {} - os-tmpdir@1.0.2: {} - ox@0.14.33(typescript@7.0.2): dependencies: '@adraffy/ens-normalize': 1.11.1 @@ -3111,7 +3106,7 @@ snapshots: semver@5.7.2: {} - solc@0.8.36: + solc@0.8.37: dependencies: command-exists: 1.2.9 commander: 8.3.0 @@ -3119,13 +3114,13 @@ snapshots: js-sha3: 0.8.0 memorystream: 0.3.1 semver: 5.7.2 - tmp: 0.0.33 + tmp: 0.2.7 transitivePeerDependencies: - debug - soltag@0.0.17(esbuild@0.28.2)(rollup@4.63.1)(solc@0.8.36)(viem@2.55.10(typescript@7.0.2))(vite@7.3.6(@types/node@25.2.0)): + soltag@0.0.17(esbuild@0.28.2)(rollup@4.63.1)(solc@0.8.37)(viem@2.55.10(typescript@7.0.2))(vite@7.3.6(@types/node@25.2.0)): dependencies: - solc: 0.8.36 + solc: 0.8.37 typescript: 5.9.3 unplugin: 3.3.0(esbuild@0.28.2)(rollup@4.63.1)(vite@7.3.6(@types/node@25.2.0)) viem: 2.55.10(typescript@7.0.2) @@ -3158,9 +3153,7 @@ snapshots: fdir: 6.5.0(picomatch@4.0.7) picomatch: 4.0.7 - tmp@0.0.33: - dependencies: - os-tmpdir: 1.0.2 + tmp@0.2.7: {} tslib@2.8.1: {} @@ -3271,7 +3264,7 @@ time: process@0.11.10: '2017-04-26T12:34:27.448Z' react-dom@19.3.0: '2026-09-09T17:17:39.744Z' react@19.3.0: '2026-09-09T17:21:30.071Z' - solc@0.8.36: '2026-07-09T09:21:35.323Z' + solc@0.8.37: '2026-09-10T10:02:54.875Z' soltag@0.0.17: '2026-04-29T07:40:57.833Z' stream-browserify@3.0.0: '2020-04-16T12:50:54.368Z' string_decoder@1.3.0: '2019-08-07T09:20:36.634Z' diff --git a/playground/pnpm-workspace.yaml b/playground/pnpm-workspace.yaml index e473f57..16ba564 100644 --- a/playground/pnpm-workspace.yaml +++ b/playground/pnpm-workspace.yaml @@ -29,3 +29,5 @@ overrides: postcss: ^8.5.24 # ReDoS and method injection via extglob / POSIX character classes picomatch: ^4.0.5 + # GHSA-ph9p-34f9-6g65, GHSA-52f5-9888-hmc6, GHSA-7c78-jf6q-g5cm; solc@0.8.37 still pins 0.2.6 + tmp: ^0.2.7 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index db21f67..0f4916a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -46,8 +46,8 @@ importers: specifier: ^6.0.0 version: 6.0.0(@types/node@25.2.0)(tsx@4.23.1) vitest: - specifier: 4.1.10 - version: 4.1.10(@types/node@25.2.0)(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1)) + specifier: 4.1.11 + version: 4.1.11(@types/node@25.2.0)(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1)) packages: @@ -582,11 +582,11 @@ packages: resolution: {integrity: sha512-ufdalm2MWOYksyj8KVpWjoOFPJO6zoYpuyvIggIQ2bB0CFCjTCiTkGXHqAKwG77GVRjOaN3/8S5ITlZpXWmqOw==} engines: {node: '>= 20'} - '@vitest/expect@4.1.10': - resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==} + '@vitest/expect@4.1.11': + resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==} - '@vitest/mocker@4.1.10': - resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==} + '@vitest/mocker@4.1.11': + resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==} peerDependencies: msw: ^2.4.9 vite: ^7.3.6 @@ -596,20 +596,20 @@ packages: vite: optional: true - '@vitest/pretty-format@4.1.10': - resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==} + '@vitest/pretty-format@4.1.11': + resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==} - '@vitest/runner@4.1.10': - resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==} + '@vitest/runner@4.1.11': + resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==} - '@vitest/snapshot@4.1.10': - resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==} + '@vitest/snapshot@4.1.11': + resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==} - '@vitest/spy@4.1.10': - resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==} + '@vitest/spy@4.1.11': + resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==} - '@vitest/utils@4.1.10': - resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==} + '@vitest/utils@4.1.11': + resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==} abitype@1.2.3: resolution: {integrity: sha512-Ofer5QUnuUdTFsBRwARMoWKOH1ND5ehwYhJ3OJ/BQO+StkwQjHw0XyVh4vDttzHB7QOFhPHa/o413PJ82gU/Tg==} @@ -720,8 +720,8 @@ packages: resolution: {integrity: sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==} engines: {node: '>=6'} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.18: + resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -903,20 +903,20 @@ packages: yaml: optional: true - vitest@4.1.10: - resolution: {integrity: sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==} + vitest@4.1.11: + resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==} engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0} hasBin: true peerDependencies: '@edge-runtime/vm': '*' '@opentelemetry/api': ^1.9.0 '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0 - '@vitest/browser-playwright': 4.1.10 - '@vitest/browser-preview': 4.1.10 - '@vitest/browser-webdriverio': 4.1.10 - '@vitest/coverage-istanbul': 4.1.10 - '@vitest/coverage-v8': 4.1.10 - '@vitest/ui': 4.1.10 + '@vitest/browser-playwright': 4.1.11 + '@vitest/browser-preview': 4.1.11 + '@vitest/browser-webdriverio': 4.1.11 + '@vitest/coverage-istanbul': 4.1.11 + '@vitest/coverage-v8': 4.1.11 + '@vitest/ui': 4.1.11 happy-dom: '*' jsdom: '*' vite: ^7.3.6 @@ -1295,44 +1295,44 @@ snapshots: '@vercel/cli-exec': 1.0.0 jose: 5.10.0 - '@vitest/expect@4.1.10': + '@vitest/expect@4.1.11': dependencies: '@standard-schema/spec': 1.1.0 '@types/chai': 5.2.3 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/spy': 4.1.11 + '@vitest/utils': 4.1.11 chai: 6.2.2 tinyrainbow: 3.1.1 - '@vitest/mocker@4.1.10(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1))': + '@vitest/mocker@4.1.11(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1))': dependencies: - '@vitest/spy': 4.1.10 + '@vitest/spy': 4.1.11 estree-walker: 3.0.3 magic-string: 0.30.21 optionalDependencies: vite: 7.3.6(@types/node@25.2.0)(tsx@4.23.1) - '@vitest/pretty-format@4.1.10': + '@vitest/pretty-format@4.1.11': dependencies: tinyrainbow: 3.1.1 - '@vitest/runner@4.1.10': + '@vitest/runner@4.1.11': dependencies: - '@vitest/utils': 4.1.10 + '@vitest/utils': 4.1.11 pathe: 2.0.3 - '@vitest/snapshot@4.1.10': + '@vitest/snapshot@4.1.11': dependencies: - '@vitest/pretty-format': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/pretty-format': 4.1.11 + '@vitest/utils': 4.1.11 magic-string: 0.30.21 pathe: 2.0.3 - '@vitest/spy@4.1.10': {} + '@vitest/spy@4.1.11': {} - '@vitest/utils@4.1.10': + '@vitest/utils@4.1.11': dependencies: - '@vitest/pretty-format': 4.1.10 + '@vitest/pretty-format': 4.1.11 convert-source-map: 2.0.0 tinyrainbow: 3.1.1 @@ -1443,7 +1443,7 @@ snapshots: mimic-fn@2.1.0: {} - nanoid@3.3.16: {} + nanoid@3.3.18: {} npm-run-path@4.0.1: dependencies: @@ -1482,7 +1482,7 @@ snapshots: postcss@8.5.25: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.18 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -1639,15 +1639,15 @@ snapshots: fsevents: 2.3.3 tsx: 4.23.1 - vitest@4.1.10(@types/node@25.2.0)(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1)): + vitest@4.1.11(@types/node@25.2.0)(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1)): dependencies: - '@vitest/expect': 4.1.10 - '@vitest/mocker': 4.1.10(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1)) - '@vitest/pretty-format': 4.1.10 - '@vitest/runner': 4.1.10 - '@vitest/snapshot': 4.1.10 - '@vitest/spy': 4.1.10 - '@vitest/utils': 4.1.10 + '@vitest/expect': 4.1.11 + '@vitest/mocker': 4.1.11(vite@7.3.6(@types/node@25.2.0)(tsx@4.23.1)) + '@vitest/pretty-format': 4.1.11 + '@vitest/runner': 4.1.11 + '@vitest/snapshot': 4.1.11 + '@vitest/spy': 4.1.11 + '@vitest/utils': 4.1.11 es-module-lexer: 2.3.1 expect-type: 1.3.0 magic-string: 0.30.21 @@ -1699,4 +1699,4 @@ time: viem@2.55.10: '2026-07-27T09:50:39.663Z' vite-node@6.0.0: '2026-03-13T14:41:46.760Z' vite@7.3.6: '2026-06-25T01:51:49.605Z' - vitest@4.1.10: '2026-07-06T06:44:42.684Z' + vitest@4.1.11: '2026-08-18T14:27:07.240Z'