fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks)

_tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture.
fix(deps): bump nanoid, dompurify for Dependabot #189 , #190
2026-08-08 08:12:20 +03:00 · 2026-08-08 01:18:49 -03:00 · 2026-08-08 00:10:31 -03:00 · 2026-08-08 00:08:57 -03:00 · 2026-08-06 23:13:28 -03:00
3 changed files with 17 additions and 9 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -250,3 +250,8 @@ tests/homolog/.auth/
 tests/homolog/ui/.auth/
 homolog-report/
 docker-compose.yml.bak
+
+# _tasks e um repo git SEPARADO (ver AGENTS.md). A linha _tasks/ (com barra) NAO
+# ignora um SYMLINK chamado _tasks; /_tasks (ancorado) cobre arquivo/symlink/dir na raiz
+# e impede que um git add -A recapture o symlink (incidente 2026-08-08).
+/_tasks
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,7 +31,7 @@
        "clsx": "^2.1.1",
        "commander": "^15.0.0",
        "csv-stringify": "^6.7.0",
-        "dompurify": "^3.4.12",
+        "dompurify": "^3.4.13",
        "express": "^5.2.1",
        "fetch-socks": "^1.3.3",
        "fflate": "^0.8.3",
@@ -17064,9 +17064,9 @@
      "license": "MIT"
    },
    "node_modules/dompurify": {
-      "version": "3.4.12",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
-      "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
+      "version": "3.4.13",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
+      "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
      "license": "(MPL-2.0 OR Apache-2.0)",
      "optionalDependencies": {
        "@types/trusted-types": "^2.0.7"
@@ -27576,9 +27576,9 @@
      "optional": true
    },
    "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
      "funding": [
        {
          "type": "github",
--- a/package.json
+++ b/package.json
@@ -256,7 +256,7 @@
    "clsx": "^2.1.1",
    "commander": "^15.0.0",
    "csv-stringify": "^6.7.0",
-    "dompurify": "^3.4.12",
+    "dompurify": "^3.4.13",
    "express": "^5.2.1",
    "fetch-socks": "^1.3.3",
    "fflate": "^0.8.3",
@@ -395,7 +395,6 @@
    ]
  },
  "overrides": {
-    "dompurify": "^3.4.12",
    "fast-xml-parser": "^5.10.1",
    "sharp": "^0.35.0",
    "postcss": "^8.5.18",
@@ -454,6 +453,10 @@
    },
    "xmlbuilder2": {
      "js-yaml": "^4.3.1"
+    },
+    "nanoid": "^3.3.17",
+    "monaco-editor": {
+      "dompurify": "^3.4.13"
    }
  }
 }
Author	SHA1	Message	Date
diegosouzapw	918fba5e39	fix(repo): harden .gitignore to also ignore a _tasks symlink (/_tasks) _tasks is a SEPARATE nested git repo (gitignored). The pattern _tasks/ (trailing slash) ignores only a directory, not a SYMLINK named _tasks. A self-referential _tasks symlink can slip in via git add -A and, once pulled, checkout materializes it over the real _tasks repo (destroying plans/specs/hands-off). Anchored /_tasks ignores the symlink too, preventing re-capture.	2026-08-08 01:18:49 -03:00
Diego Rodrigues de Sa e Souza	026e1cadaa	fix(deps): bump nanoid, dompurify for Dependabot #189 , #190 Closes Dependabot #189 (dompurify 3.4.13) and #190 (nanoid 3.3.17). npm audit → 0.	2026-08-08 00:10:31 -03:00
diegosouzapw	b090b601a5	fix(deps): bump nanoid, dompurify for 2 new Dependabot alerts (#189 , #190 ) Bumps: nanoid ^3.3.17 (was transitive, now overridden), dompurify ^3.4.13 (with monaco-editor scoped override). Closes Dependabot #189, #190. Remaining #182-#188 (js-yaml + mermaid) already closed by #9651 merge — awaiting Dependabot re-scan. npm audit → 0 vulnerabilities.	2026-08-08 00:08:57 -03:00
Diego Rodrigues de Sa e Souza	153f453b0b	fix(deps): bump deps for 13 Dependabot + audit cleanup on main Same overrides as #9464 (ip-address, hono, fast-uri, socket.io-parser, undici) + brace-expansion, js-yaml v4, mermaid. npm audit → 0 vulnerabilities. Closes Dependabot #161-#188.	2026-08-06 23:13:28 -03:00