diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1f1e4be..4209dd1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,10 +11,13 @@ overrides: ws@<8.21.0: '>=8.21.0 <9.0.0' form-data@<4.0.6: '>=4.0.6 <5.0.0' websocket-driver: '>=0.7.5' - brace-expansion@1: '>=1.1.16 <2' - js-yaml@4: '>=4.3.0' + minimatch@<10.0.0: '>=10.2.4' + brace-expansion@1: '>=5.0.8' + js-yaml@4: '>=5.2.2' shell-quote: '>=1.9.0' - brace-expansion@>=3 <5.0.7: '>=5.0.7' + brace-expansion@>=3 <5.0.8: '>=5.0.8' + postcss@<8.5.18: '>=8.5.18' + fast-uri@>=3.0.0 <3.1.4: '>=3.1.4' importers: @@ -816,9 +819,6 @@ packages: asynckit@0.4.0: resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -842,12 +842,9 @@ packages: bonjour-service@1.3.0: resolution: {integrity: sha512-3YuAUiSkWykd+2Azjgyxei8OWf8thdn8AITIog2M4UICzoqfjlqr64WIjEXZllf/W6vK1goqleSR6brGomxQqA==} - brace-expansion@1.1.16: - resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.8: + resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + engines: {node: 20 || >=22} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -956,9 +953,6 @@ packages: resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} engines: {node: '>= 0.8.0'} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - connect-history-api-fallback@2.0.0: resolution: {integrity: sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA==} engines: {node: '>=0.8'} @@ -1285,8 +1279,8 @@ packages: fast-levenshtein@2.0.6: resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@4.1.1: + resolution: {integrity: sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ==} fastest-levenshtein@1.0.16: resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==} @@ -1661,8 +1655,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@5.2.1: - resolution: {integrity: sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==} + js-yaml@5.2.2: + resolution: {integrity: sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==} hasBin: true jsdom@25.0.1: @@ -1895,9 +1889,6 @@ packages: resolution: {integrity: sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - minimist-options@4.1.0: resolution: {integrity: sha512-Q4r8ghd80yhO/0j1O3B2BjweX3fiHg9cdOwjJd2J76Q135c+NDxGCqdYKQ1SKBuFfgWbAUzBfvYjPUEeNgqN1A==} engines: {node: '>= 6'} @@ -1915,8 +1906,8 @@ packages: mute-stream@0.0.8: resolution: {integrity: sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==} - nanoid@3.3.12: - resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -2064,8 +2055,8 @@ packages: resolution: {integrity: sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==} engines: {node: '>=16.0.0'} - postcss@8.5.15: - resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==} + postcss@8.5.20: + resolution: {integrity: sha512-lW616l85ucIQL+FocMmL7pQFPqBmwejrCMg+iPxyImlrANNJG9NHq/RkyCZopDhd8C3LA03PHRJDjkbGu8vvug==} engines: {node: ^10 || ^12 || >=14} prelude-ls@1.2.1: @@ -2891,7 +2882,7 @@ snapshots: dependencies: '@eslint/object-schema': 2.1.7 debug: 4.4.3 - minimatch: 3.1.5 + minimatch: 10.2.4 transitivePeerDependencies: - supports-color @@ -2927,8 +2918,8 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 5.2.1 - minimatch: 3.1.5 + js-yaml: 5.2.2 + minimatch: 10.2.4 strip-json-comments: 3.1.1 transitivePeerDependencies: - supports-color @@ -3635,7 +3626,7 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 4.1.1 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -3678,8 +3669,6 @@ snapshots: asynckit@0.4.0: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} baseline-browser-mapping@2.10.11: {} @@ -3710,12 +3699,7 @@ snapshots: fast-deep-equal: 3.1.3 multicast-dns: 7.2.5 - brace-expansion@1.1.16: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - - brace-expansion@5.0.7: + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -3830,8 +3814,6 @@ snapshots: transitivePeerDependencies: - supports-color - concat-map@0.0.1: {} - connect-history-api-fallback@2.0.0: {} content-disposition@0.5.4: @@ -4092,7 +4074,7 @@ snapshots: is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 lodash.merge: 4.6.2 - minimatch: 3.1.5 + minimatch: 10.2.4 natural-compare: 1.4.0 optionator: 0.9.4 transitivePeerDependencies: @@ -4198,7 +4180,7 @@ snapshots: fast-levenshtein@2.0.6: {} - fast-uri@3.1.2: {} + fast-uri@4.1.1: {} fastest-levenshtein@1.0.16: {} @@ -4564,7 +4546,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@5.2.1: + js-yaml@5.2.2: dependencies: argparse: 2.0.1 @@ -4782,11 +4764,7 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.7 - - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.16 + brace-expansion: 5.0.8 minimist-options@4.1.0: dependencies: @@ -4805,7 +4783,7 @@ snapshots: mute-stream@0.0.8: {} - nanoid@3.3.12: {} + nanoid@3.3.16: {} natural-compare@1.4.0: {} @@ -4943,9 +4921,9 @@ snapshots: pvutils: 1.1.5 tslib: 2.8.1 - postcss@8.5.15: + postcss@8.5.20: dependencies: - nanoid: 3.3.12 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -5460,7 +5438,7 @@ snapshots: dependencies: lightningcss: 1.32.0 picomatch: 4.0.4 - postcss: 8.5.15 + postcss: 8.5.20 rolldown: 1.0.3 tinyglobby: 0.2.17 optionalDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 279a30d..c58ad3e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -7,6 +7,10 @@ minimumReleaseAgeExclude: - '@esbuild/*' - form-data - tmp + # brace-expansion 5.0.8 / js-yaml 5.2.2 (いずれも 2026-07-23 公開) が + # minimumReleaseAge (7日) を超えたら削除すること -> 2026-07-31 以降 + - brace-expansion + - js-yaml overrides: shell-quote@<1.8.4: ">=1.8.4" tmp@<0.2.7: '>=0.2.7 <1.0.0' @@ -15,10 +19,22 @@ overrides: form-data@<4.0.6: '>=4.0.6 <5.0.0' # 2026-07 audit 波の新規 advisory 対応 'websocket-driver': '>=0.7.5' - 'brace-expansion@1': '>=1.1.16 <2' - 'js-yaml@4': '>=4.3.0' + # brace-expansion は 5.0.7 以下が全て脆弱になり 1 系に安全版が無い。 + # 1 系を要求するのは minimatch 3 系のみなので、minimatch 側を + # brace-expansion 5 系を使う 10 系へ引き上げて解消する。 + 'minimatch@<10.0.0': '>=10.2.4' + 'brace-expansion@1': '>=5.0.8' + # 上限なしのため実際には js-yaml 5 系が入る。5.2.1 以下が新たに脆弱化 + # したので下限を 5.2.2 へ引き上げる。 + # (override セレクタは解決後の版ではなく親が宣言するレンジに対して + # マッチするため、js-yaml@5 のセレクタを足しても発火しない) + 'js-yaml@4': '>=5.2.2' 'shell-quote': '>=1.9.0' - 'brace-expansion@>=3 <5.0.7': '>=5.0.7' + # 2026-07-27 audit 波。既存 override は 5.0.7 / 4系 を指しており、 + # 5.0.7 自身・5系 が新たに脆弱化した分をセレクタごと引き上げる。 + 'brace-expansion@>=3 <5.0.8': '>=5.0.8' + 'postcss@<8.5.18': '>=8.5.18' + 'fast-uri@>=3.0.0 <3.1.4': '>=3.1.4' packageManagerStrictVersion: true savePrefix: "" trustPolicy: no-downgrade