[YLfjuk]

CORE-02 clears the five development dependency advisories that fail the root CI audit on main at e195ff7. The current audit on 2026-10-18 reproduced three critical, one high, and one moderate advisory; the production-only audit already reported zero.

Only pnpm-lock.yaml and pnpm-workspace.yaml change. Package manifests, direct parent versions, pnpm 11.22.0, public APIs, runtime dependencies, and publication behavior are unchanged. No publication changeset is needed for this development tooling fix.

Locked changes and primary advisory sources:

• tinypool 2.1.0 → 2.1.2 via oxfmt 0.61.0, including the @ylfjuk/oxc peer path. Fixes critical GHSA-5gmw-xhrv-c9v3, patched in 2.1.1, and critical GHSA-85c8-ppgw-ccpr, patched in 2.1.2. These are prototype pollution gadgets that require an upstream pollution primitive to reach worker code execution. Oxfmt pins tinypool exactly to 2.1.0, so a lockfile refresh cannot satisfy its constraint. The narrow oxfmt@0.61.0>tinypool: 2.1.2 override avoids a formatter migration. Its adjacent comment says to remove it after upgrading this repo's oxfmt to a version requiring tinypool >=2.1.2.
• shell-quote 1.10.0 → 1.12.0 via Changesets 3.0.1 / launch-editor 2.14.1, within launch-editor's existing ^1.8.4 range. Fixes critical GHSA-pqg4-j6r4-53mv, patched in 1.11.0. Command injection requires an attacker-controlled line terminator in a string following a comment token passed through quote() to a shell.
• source-map-js 1.2.1 → 1.2.2 via Vitest/Vite/PostCSS and coverage/magicast, within existing ^1.2.1 ranges. Fixes high GHSA-68fv-2mgg-jv7q, patched in 1.2.2, concerning denial of service from malicious indexed source-map section offsets.
• smol-toml 1.8.0 → 1.9.1 via Knip 6.32.2, within its existing ^1.7.1 range. Fixes moderate GHSA-r4xh-jqrq-34v2, concerning quadratic parsing of TOML keys. npm audit reports >=1.8.1 as patched, but the upstream advisory names 1.9.0; 1.9.1 satisfies both sources.

All affected paths are development tooling, verified with pnpm why. No production exploit has been established in this repository. The three unconstrained transitives were refreshed with pinned pnpm using existing declared ranges; no broader parent upgrades were needed.

Current revision: 0fcc04d547f79a2f2a0bb90e852927a487ee727e. The follow-up changes only the override comment in pnpm-workspace.yaml to clarify that removal depends on this repo upgrading oxfmt. It retains the note that oxfmt 0.61.0 pins vulnerable tinypool 2.1.0. The lockfile is byte-for-byte identical to reviewed head aa2361532c26201c7c5298ec0c433aaebefe2129; overrides, dependency versions, and behavior are unchanged.

Focused follow-up validation on Windows, Node v24.19.0 and pnpm 11.22.0, all exit 0:

• pnpm install --frozen-lockfile: installed tooling in the fresh isolated checkout without changing the lockfile
• pnpm run fmt:check: 182 files pass
• git diff --check
• Lockfile blob comparison against aa2361532c26201c7c5298ec0c433aaebefe2129: identical

Full audits, lint, types, runtime tests, coverage, and build were not rerun for this comment-only revision. The following full-suite results belong to prior head aa2361532c26201c7c5298ec0c433aaebefe2129, independently repeated by the Tests reviewer on Windows, Node v24.19.0 and pnpm 11.22.0, all exit 0:

• pnpm install --frozen-lockfile
• pnpm audit and pnpm audit --prod: zero advisories, without filtering or ignores
• pnpm run fmt:check
• pnpm run lint: ten warnings in unchanged test files, no errors
• pnpm run test:types: all three packages pass
• pnpm run test: 65 files, 340 passed, five existing TODOs
• pnpm run coverage: same test totals; statements 100%, branches 100%, functions 96.42%, lines 100%
• pnpm run build: all three package builds pass, including publint and attw with the existing esm-only profile
• git diff --check

Limits: main's known CORE-01 gap remains: ordinary tests do not compile the .spec.ts type assertions. Passing these baseline checks does not fix or validate type discovery or the enum assertion exposed by it. No PR16/PR17 patches were applied and no cumulative integration run was performed. Build output retains existing experimental TypeScript/Vitest notices, the types package's CJS warning ignored by esm-only, and Turbo's warning that the types build has no output files. GitHub push still reports an alert on the unchanged default branch; the full audit of this branch is clean. Linux Validate passed at prior head aa2361532c26201c7c5298ec0c433aaebefe2129, including frozen installation, formatting, lint, types, tests, coverage, build, and full audit. Independent Security and Tests reviews completed at that same SHA with no blocking findings; this comment clarification addresses the sole low-severity Security nit, CORE02-F1. Those reviews and the Linux result apply to the prior SHA, not the current revision. No CI outcome is claimed for the current revision; HQ retains final disposition.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0fcc04d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR