Diego Rodrigues de Sa e Souza 7c39a0e065 chore(deps): bump js-yaml, brace-expansion, shell-quote, tar (security) (#7915) ...

Resolves all 11 open Dependabot alerts (lockfile-only; no runtime code change):

- js-yaml 4.2.0 -> 4.3.0 (CVE-2026-59869 / GHSA-52cp-r559-cp3m, high) - root + electron
- brace-expansion 1.1.x/2.1.1/5.0.6 -> 1.1.16/2.1.2/5.0.7 (CVE-2026-13149 /
  GHSA-3jxr-9vmj-r5cp, high) - root + electron
- shell-quote 1.8.4 -> 1.10.0 (CVE-2026-13311 / GHSA-395f-4hp3-45gv, high) - root.
  concurrently (latest 10.0.3) pins shell-quote exactly at 1.8.4, so this adds a
  per-parent override, same pattern as @yarnpkg/parsers.js-yaml
- tar 7.5.16 -> 7.5.20 (CVE-2026-59871 / GHSA-w8wr-v893-vjvp, medium) - root + electron

2026-07-21 11:49:51 -03:00

28 KiB

Raw Blame History

View Raw