[stamp-build]

^{NotZZ from botiverse opened this pull request through Stamp
View in Stamp →}

---

What

Fix the OSV-reported vulnerabilities in pnpm-lock.yaml that have a fix in the same major line, via pnpm.overrides; lockfile regenerated with pnpm 9.12.0 (--lockfile-only).

Package	From → to	Advisories
undici (existing override)	7.29.1 → 7.30.1	8
electron (existing override)	43.5.0 → 43.8.1	8
nanoid@3	3.3.15 → 3.3.18	2
postcss	8.5.15 → 8.5.23	2
js-yaml@4	4.2.0 → 4.3.2	3
browserslist	4.28.4 → 4.28.7	2
baseline-browser-mapping	2.10.40 → 2.11.0	1

Why

zhiqiang (2026-11-03, #superzz-botiverse): fix what has a fixed version. Source: the daily OSV scan added in #881 (run 41631971568: 47 advisories in 16 packages).

Verification

• osv-scanner scan source -L pnpm-lock.yaml (v2.7.0) on this head: 26 advisories gone, 20 remain in the pnpm lockfile, all needing a major upgrade (below).
• Locally (Node 24, pnpm 9.12.0, install --frozen-lockfile):
  • packages/node 32/32, packages/agent-session-store 13/13, packages/cli 198/198 (after building hands-node and agent-session-store, as CI does) pass;
  • admin vite build succeeds.
  • worker tests could not run on this ARM host: better-sqlite3's native binding is not built there (environment, not this change). worker-tests.yml runs on this PR because it touches package.json and pnpm-lock.yaml.

Not in this PR (need code changes / owner decision)

• vite 5 → 6 (8 advisories, plus esbuild 0.21 → 0.25 through it), vitest 2 → 3/4 (incl. the CVSS 9.8 GHSA-5xrq-8626-4rwp, test runner only) and @⁠vitest/mocker.
• react-router 6 → 7 (2, admin).
• minimatch 3 → 11 (1).
• sharp 0.34 → 0.35 (3, via miniflare / wrangler dev).
• @⁠hono/node-server 1 → 2 (1 in pnpm-lock.yaml, 1 in container/package-lock.json).

[stamp-build]

@bytemain CI 全绿了（worker 测试 test、cli、build、play-adapter、windows-device-id、CodeQL 都通过）。这是 zhiqiang 要的"有修复版本的漏洞先修掉"：只在同一个大版本内升了 7 个依赖，去掉了 26 个漏洞。改动只有 package.json 的 overrides 和 lockfile。麻烦审一下、合一下。需要升大版本的那 21 个列在描述里，没有动。

---

^{NotZZ commented through Stamp · server botiverse · head when posted 3711417
View in Stamp →}