From b346e1b9696f8819df76daf29c4c183ff23ed646 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 02:37:26 +0000 Subject: [PATCH 1/3] build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.1 Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 4.37.9 to 4.38.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...1c5b675653bb5c22dbe9b12b556ec555138e09fd) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b55e4c4..5147c8d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: languages: javascript-typescript build-mode: none From 85a0b0a884f726c64f9a280374f88d792ed5e8b4 Mon Sep 17 00:00:00 2001 From: Florian2807 <84639717+Florian2807@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:51:49 +0200 Subject: [PATCH 2/3] fix(deps): patch js-yaml audit vulnerabilities --- pnpm-lock.yaml | 20 ++++++++++---------- pnpm-workspace.yaml | 8 ++++---- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index dbe640c..ee62704 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,8 +10,8 @@ overrides: brace-expansion@>=4.0.0 <5.0.9: 5.0.9 decode-uri-component@<0.5.0: 0.5.0 esbuild@<=0.24.2: 0.25.0 - js-yaml@>=3.0.0 <3.15.1: 3.15.1 - js-yaml@>=4.0.0 <4.3.1: 4.3.1 + js-yaml@>=3.0.0 <3.15.2: 3.15.2 + js-yaml@>=4.0.0 <4.3.2: 4.3.2 nanoid@<3.3.18: 3.3.18 postcss@<=8.5.22: 8.5.23 uuid@<11.1.1: ^11.1.1 @@ -4096,12 +4096,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.1: - resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} + js-yaml@3.15.2: + resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} hasBin: true - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsc-safe-url@0.2.4: @@ -6951,7 +6951,7 @@ snapshots: dependencies: '@babel/code-frame': 7.29.7 chalk: 4.1.2 - js-yaml: 4.3.1 + js-yaml: 4.3.2 '@hono/node-server@2.1.1(hono@4.13.5)': dependencies: @@ -6964,7 +6964,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.15.1 + js-yaml: 3.15.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -9736,12 +9736,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.1: + js-yaml@3.15.2: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ea55e7f..05bc161 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -37,8 +37,8 @@ minimumReleaseAgeExclude: - uuid@11.1.1 - brace-expansion@5.0.8 - brace-expansion@5.0.9 - - js-yaml@3.15.1 - - js-yaml@4.3.1 + - js-yaml@3.15.2 + - js-yaml@4.3.2 - nanoid@3.3.18 - postcss@8.5.23 - '@expo/inline-modules@0.1.6' @@ -56,8 +56,8 @@ overrides: brace-expansion@>=4.0.0 <5.0.9: 5.0.9 decode-uri-component@<0.5.0: 0.5.0 esbuild@<=0.24.2: 0.25.0 - js-yaml@>=3.0.0 <3.15.1: 3.15.1 - js-yaml@>=4.0.0 <4.3.1: 4.3.1 + js-yaml@>=3.0.0 <3.15.2: 3.15.2 + js-yaml@>=4.0.0 <4.3.2: 4.3.2 nanoid@<3.3.18: 3.3.18 postcss@<=8.5.22: 8.5.23 uuid@<11.1.1: ^11.1.1 From 3f837811dd901dccee3221e2f3e2893b5201dec3 Mon Sep 17 00:00:00 2001 From: Florian2807 <84639717+Florian2807@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:52:58 +0200 Subject: [PATCH 3/3] fix(ci): keep CodeQL actions on the same version --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5147c8d..8cf67d5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,6 +36,6 @@ jobs: build-mode: none - name: Analyze - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1 with: category: /language:javascript-typescript