fix(deps): resolve seven Dependabot alerts #1

Closed
xixu-me wants to merge 0 commits from fix/dependabot-october-alerts into main
pull from: fix/dependabot-october-alerts
Owner

Dependabot reports vulnerable brace-expansion 2.x/5.x and source-map-js in pnpm-lock.yaml. Pin compatible patched versions (2.1.7, 5.0.12, and 1.2.2) and refresh the lockfile to resolve alerts #67–72 and #75.

Validation: frozen pnpm install, existing dependency-security regression test, Nitro production build, and the CI audit command pass. The full production audit now reports only two high advisories with no published fix: braces (GHSA-vfj7-8cjw-p6xm, #74) and node-forge (GHSA-86w9-cpqp-85rv, #73), introduced by Nitro through globby/micromatch and listhen respectively. Those alerts remain open.


GitHub 来源:https://github.com/xixu-me/xdpl/pull/12
作者:xixu-me · 创建时间:2026-10-08T06:33:12Z
GitHub PR 状态:已合并,合并提交 088bfcf1e4

Dependabot reports vulnerable brace-expansion 2.x/5.x and source-map-js in pnpm-lock.yaml. Pin compatible patched versions (2.1.7, 5.0.12, and 1.2.2) and refresh the lockfile to resolve alerts #67–72 and #75. Validation: frozen pnpm install, existing dependency-security regression test, Nitro production build, and the CI audit command pass. The full production audit now reports only two high advisories with no published fix: braces (GHSA-vfj7-8cjw-p6xm, #74) and node-forge (GHSA-86w9-cpqp-85rv, #73), introduced by Nitro through globby/micromatch and listhen respectively. Those alerts remain open. --- GitHub 来源:https://github.com/xixu-me/xdpl/pull/12 作者:xixu-me · 创建时间:2026-10-08T06:33:12Z GitHub PR 状态:已合并,合并提交 088bfcf1e4642f9b3aedf56766508b49828fe691 <!-- github-archive:4782820123 -->
xixu-me added 1 commit 2026-10-08 06:36:10 +00:00
Author
Owner

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
xdpl0 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl1 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl2 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl3 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl4 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl5 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl6 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl7 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl8 Ready Ready Preview Oct 8, 2026 6:35am UTC
xdpl9 Ready Ready Preview Oct 8, 2026 6:35am UTC

GitHub 来源:https://github.com/xixu-me/xdpl/pull/12#issuecomment-6053939190
作者:vercel[bot] · 创建时间:2026-10-08T06:33:13Z

[vc]: #t00EZgdMzl4tSjZfVRb+kY1Q5Pt7RgLYrdQrlqQoMe4=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ4ZHBsOCIsInByb2plY3RJZCI6InByal80ZnBvUkgwYWw5MTc0QzBQU2pFTW1aQjhIZTZrIiwicm9vdERpcmVjdG9yeSI6bnVsbCwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3hpLWluYy94ZHBsOC81UHlIeXF6eHIzQlNLc2pVNHljeUZMZEpRVnJxIiwicHJldmlld1VybCI6InhkcGw4LWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ4ZHBsOC1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAifX0seyJuYW1lIjoieGRwbDYiLCJwcm9qZWN0SWQiOiJwcmpfUGlqcU4yRWZpcm1oSzVQNGdUQm1ZVENoMXlBRSIsInJvb3REaXJlY3RvcnkiOm51bGwsImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS94aS1pbmMveGRwbDYvMm9HVmpqcWlNOVdtTURRN3d3SExOZnVuRXpuZCIsInByZXZpZXdVcmwiOiJ4ZHBsNi1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAiLCJuZXh0Q29tbWl0U3RhdHVzIjoiREVQTE9ZRUQiLCJsaXZlRmVlZGJhY2siOnsicmVzb2x2ZWQiOjAsInVucmVzb2x2ZWQiOjAsInRvdGFsIjowLCJsaW5rIjoieGRwbDYtZ2l0LWZpeC1kZXBlbmRhYm90LW9jdG9iZXItYWxlcnRzLXhpLWluYy52ZXJjZWwuYXBwIn19LHsibmFtZSI6InhkcGwyIiwicHJvamVjdElkIjoicHJqX3RxdEVkR25rUG5sVkZ5ajNvaldsQXptRk9BUlgiLCJyb290RGlyZWN0b3J5IjpudWxsLCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20veGktaW5jL3hkcGwyLzVHV0ZOSlc5am1YeXFvYjdhOUR3VXEzOWd3MkwiLCJwcmV2aWV3VXJsIjoieGRwbDItZ2l0LWZpeC1kZXBlbmRhYm90LW9jdG9iZXItYWxlcnRzLXhpLWluYy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIiwibGl2ZUZlZWRiYWNrIjp7InJlc29sdmVkIjowLCJ1bnJlc29sdmVkIjowLCJ0b3RhbCI6MCwibGluayI6InhkcGwyLWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCJ9fSx7Im5hbWUiOiJ4ZHBsMSIsInByb2plY3RJZCI6InByal9RYlNZbXNtS3NveU9WUUx2N0ZLd3FMT2VwVTlmIiwicm9vdERpcmVjdG9yeSI6bnVsbCwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3hpLWluYy94ZHBsMS8xMjFIdk1qQjJld3V5ZDNSY0VvUDVZR0NYZ3hCIiwicHJldmlld1VybCI6InhkcGwxLWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ4ZHBsMS1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAifX0seyJuYW1lIjoieGRwbDUiLCJwcm9qZWN0SWQiOiJwcmpfU2h3TEM4QnB2TVUwQng1S1F0alZId21JUUdXdyIsInJvb3REaXJlY3RvcnkiOm51bGwsImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS94aS1pbmMveGRwbDUvM2UzcDlUWUZReW92WlhydGpqRE41OExSVkNRRCIsInByZXZpZXdVcmwiOiJ4ZHBsNS1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAiLCJuZXh0Q29tbWl0U3RhdHVzIjoiREVQTE9ZRUQiLCJsaXZlRmVlZGJhY2siOnsicmVzb2x2ZWQiOjAsInVucmVzb2x2ZWQiOjAsInRvdGFsIjowLCJsaW5rIjoieGRwbDUtZ2l0LWZpeC1kZXBlbmRhYm90LW9jdG9iZXItYWxlcnRzLXhpLWluYy52ZXJjZWwuYXBwIn19LHsibmFtZSI6InhkcGwwIiwicHJvamVjdElkIjoicHJqX2lVWnAycm02T1o1UDNuQnpDRDV2cmM3VThIdUciLCJyb290RGlyZWN0b3J5IjpudWxsLCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20veGktaW5jL3hkcGwwL0ZBSFBOS0diTnlmQkdBdFZ6MU10elNIZHZLQ0giLCJwcmV2aWV3VXJsIjoieGRwbDAtZ2l0LWZpeC1kZXBlbmRhYm90LW9jdG9iZXItYWxlcnRzLXhpLWluYy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIiwibGl2ZUZlZWRiYWNrIjp7InJlc29sdmVkIjowLCJ1bnJlc29sdmVkIjowLCJ0b3RhbCI6MCwibGluayI6InhkcGwwLWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCJ9fSx7Im5hbWUiOiJ4ZHBsOSIsInByb2plY3RJZCI6InByal9Yc21ITEdMZzgwaVdxV1lrSDI3VnlqeDg0MHY4Iiwicm9vdERpcmVjdG9yeSI6bnVsbCwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3hpLWluYy94ZHBsOS84R0FYdnJFaFNid1dKV0pjeWc1NW5xeEdLMXZpIiwicHJldmlld1VybCI6InhkcGw5LWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ4ZHBsOS1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAifX0seyJuYW1lIjoieGRwbDQiLCJwcm9qZWN0SWQiOiJwcmpfN3lCY2JhQlo2S2hBOHNBRDJSVTNHRXo1ZW5LZCIsInJvb3REaXJlY3RvcnkiOm51bGwsImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS94aS1pbmMveGRwbDQvRXN3WGRRTmJGZTRWQVFiV0U2cXk1b1FOVmE5USIsInByZXZpZXdVcmwiOiJ4ZHBsNC1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAiLCJuZXh0Q29tbWl0U3RhdHVzIjoiREVQTE9ZRUQiLCJsaXZlRmVlZGJhY2siOnsicmVzb2x2ZWQiOjAsInVucmVzb2x2ZWQiOjAsInRvdGFsIjowLCJsaW5rIjoieGRwbDQtZ2l0LWZpeC1kZXBlbmRhYm90LW9jdG9iZXItYWxlcnRzLXhpLWluYy52ZXJjZWwuYXBwIn19LHsibmFtZSI6InhkcGwzIiwicHJvamVjdElkIjoicHJqX2ZhSlpsV0Mwd3N0cUFRbU9lemcybHlqQUtOem0iLCJyb290RGlyZWN0b3J5IjpudWxsLCJpbnNwZWN0b3JVcmwiOiJodHRwczovL3ZlcmNlbC5jb20veGktaW5jL3hkcGwzL3RSTWZ3bVlFeTNIcUpDVmJvWGJNWEJOOTRhOXUiLCJwcmV2aWV3VXJsIjoieGRwbDMtZ2l0LWZpeC1kZXBlbmRhYm90LW9jdG9iZXItYWxlcnRzLXhpLWluYy52ZXJjZWwuYXBwIiwibmV4dENvbW1pdFN0YXR1cyI6IkRFUExPWUVEIiwibGl2ZUZlZWRiYWNrIjp7InJlc29sdmVkIjowLCJ1bnJlc29sdmVkIjowLCJ0b3RhbCI6MCwibGluayI6InhkcGwzLWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCJ9fSx7Im5hbWUiOiJ4ZHBsNyIsInByb2plY3RJZCI6InByal9FQ3lyakkyQVliVUFUVVpIWmE4S2wxb2VFVjVGIiwicm9vdERpcmVjdG9yeSI6bnVsbCwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwuY29tL3hpLWluYy94ZHBsNy9BUU5DRjZaOTROU1hlVWRob2ROZEoxajNuV01rIiwicHJldmlld1VybCI6InhkcGw3LWdpdC1maXgtZGVwZW5kYWJvdC1vY3RvYmVyLWFsZXJ0cy14aS1pbmMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ4ZHBsNy1naXQtZml4LWRlcGVuZGFib3Qtb2N0b2Jlci1hbGVydHMteGktaW5jLnZlcmNlbC5hcHAifX1dfQ== The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated | | :--- | :----- | :------ | :------ | | <a href="https://vercel.com/xi-inc/xdpl0"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_iUZp2rm6OZ5P3nBzCD5vrc7U8HuG&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl0](https://vercel.com/xi-inc/xdpl0) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl0/FAHPNKGbNyfBGAtVz1MtzSHdvKCH) | [Preview](https://xdpl0-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.343Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl1"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_QbSYmsmKsoyOVQLv7FKwqLOepU9f&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl1](https://vercel.com/xi-inc/xdpl1) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl1/121HvMjB2ewuyd3RcEoP5YGCXgxB) | [Preview](https://xdpl1-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.344Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl2"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_tqtEdGnkPnlVFyj3ojWlAzmFOARX&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl2](https://vercel.com/xi-inc/xdpl2) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl2/5GWFNJW9jmXyqob7a9DwUq39gw2L) | [Preview](https://xdpl2-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.344Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl3"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_faJZlWC0wstqAQmOezg2lyjAKNzm&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl3](https://vercel.com/xi-inc/xdpl3) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl3/tRMfwmYEy3HqJCVboXbMXBN94a9u) | [Preview](https://xdpl3-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.344Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl4"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_7yBcbaBZ6KhA8sAD2RU3GEz5enKd&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl4](https://vercel.com/xi-inc/xdpl4) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl4/EswXdQNbFe4VAQbWE6qy5oQNVa9Q) | [Preview](https://xdpl4-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.345Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl5"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_ShwLC8BpvMU0Bx5KQtjVHwmIQGWw&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl5](https://vercel.com/xi-inc/xdpl5) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl5/3e3p9TYFQyovZXrtjjDN58LRVCQD) | [Preview](https://xdpl5-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.345Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl6"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_PijqN2EfirmhK5P4gTBmYTCh1yAE&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl6](https://vercel.com/xi-inc/xdpl6) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl6/2oGVjjqiM9WmMDQ7wwHLNfunEznd) | [Preview](https://xdpl6-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.345Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl7"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_ECyrjI2AYbUATUZHZa8Kl1oeEV5F&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl7](https://vercel.com/xi-inc/xdpl7) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl7/AQNCF6Z94NSXeUdhodNdJ1j3nWMk) | [Preview](https://xdpl7-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.345Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl8"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_4fpoRH0al9174C0PSjEMmZB8He6k&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl8](https://vercel.com/xi-inc/xdpl8) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl8/5PyHyqzxr3BSKsjU4ycyFLdJQVrq) | [Preview](https://xdpl8-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.345Z">Oct 8, 2026 6:35am UTC</relative-time> | | <a href="https://vercel.com/xi-inc/xdpl9"><sup><img src="https://vercel.com/api/www/avatar?projectId=prj_XsmHLGLg80iWqWYkH27Vyjx840v8&teamId=team_WhwZiKNLo4tbZq0z09xe0B46&s=32" width="16" height="16" align="middle" alt="" /></sup></a> [xdpl9](https://vercel.com/xi-inc/xdpl9) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/xi-inc/xdpl9/8GAXvrEhSbwWJWJcyg55nqxGK1vi) | [Preview](https://xdpl9-git-fix-dependabot-october-alerts-xi-inc.vercel.app) | <relative-time datetime="2026-10-08T06:35:42.346Z">Oct 8, 2026 6:35am UTC</relative-time> | --- GitHub 来源:https://github.com/xixu-me/xdpl/pull/12#issuecomment-6053939190 作者:vercel[bot] · 创建时间:2026-10-08T06:33:13Z <!-- github-archive:6053939190 -->
xixu-me closed this pull request 2026-10-08 06:37:43 +00:00
xixu-me deleted branch fix/dependabot-october-alerts 2026-10-08 06:37:49 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.