diegosouzapw 384ce49a4d chore(deps): patch toml and esbuild in the opencode plugin lockfiles ...

Two Dependabot alerts on the opencode plugin workspaces, both dev-scope:

- #209 (high) toml@4.1.1 — prototype pollution via `__proto__` key-path
  desynchronization (GHSA-v5mp-jgw5-2x6j), pulled transitively by `effect`
  under `@opencode-ai/plugin`. Patched in 4.1.2.
- #210 (low) esbuild@0.27.7 — arbitrary file read from the dev server on
  Windows (GHSA-g7r4-m6w7-qqqr), nested under `tsup`. Patched in 0.28.1.
  The top-level esbuild was already 0.28.1; only the nested copy lagged.

Both are resolved with an `overrides` entry, reusing the pattern the v1
plugin already applies to esbuild. Neither package reaches the published
runtime — they are build-time only — so this is hygiene, not an exposure fix.

toml 4.1.1 -> 4.3.0, nested esbuild 0.27.7 dropped (single 0.28.2 remains).
`npm install` reports 0 vulnerabilities in both workspaces; both plugins
build and their suites pass (367 and 218 tests).

2026-09-07 11:14:49 -03:00

2.4 KiB

Raw Blame History

View Raw