DM-55688: Pin patched transitive deps to clear 12 security advisories

[jonathansick]

Summary

Clears 12 of the 13 open Dependabot security advisories on main. Every one is a transitive-only dependency in pnpm-lock.yaml — no direct dependency of any workspace package is vulnerable.

Dependabot cannot fix these on its own: five alerts report update_not_possible and the remaining seven produced no PR and no error, despite automated security fixes being enabled and unpaused. Its successful security PRs in this repo (#595, #611, #616) all bumped a direct manifest dependency. Dependabot's pnpm support does not open security PRs for transitive-only updates, so this repo's security-alert stream is manual in practice.

Two changes:

• A root pnpm.overrides block pinning patched versions of brace-expansion, js-yaml, postcss, immutable, and fast-uri.
• The vitest family moved to 4.1.10 within its existing ^4.1.0 range. This clears the @vitest/browser advisory without an override — overriding a direct devDependency that Dependabot already manages would just fight it. The manifest range floors move to ^4.1.10 to record the security floor.

Alerts resolved

Alert	Package	Advisory	Sev	Resolved to
#274, #275, #276	brace-expansion	GHSA-3jxr-9vmj-r5cp / CVE-2026-13149	high	1.1.18 / 2.1.4 / 5.0.9
#296, #297	brace-expansion	GHSA-mh99-v99m-4gvg / CVE-2026-14257	high	2.1.4 / 5.0.9
#277	js-yaml	GHSA-52cp-r559-cp3m / CVE-2026-59869	high	4.3.1
#278	immutable	GHSA-v56q-mh7h-f735 / CVE-2026-59879	high	5.1.9
#279	immutable	GHSA-xvcm-6775-5m9r / CVE-2026-59880	high	5.1.9
#280	fast-uri	GHSA-4c8g-83qw-93j6 / CVE-2026-13676	high	3.1.5
#283	fast-uri	GHSA-v2hh-gcrm-f6hx / CVE-2026-16221	high	3.1.5
#281	@vitest/browser	GHSA-p63j-vcc4-9vmv	critical	4.1.10
#293	postcss	GHSA-r28c-9q8g-f849	high	8.5.25

Deliberately not included: sharp (#282)

sharp's patched version 0.35.0 falls outside next@16.2.12's declared ^0.34.5 range, so pinning it means forcing a dependency out of range and revalidating image optimization.

The exposure does not justify that. The advisory is inherited libvips CVEs that require processing a malicious image. apps/squareone/next.config.js declares no images.remotePatterns, and every next/image use (Footer, PreHeader, FooterRsc) points at a repo-controlled static asset — no attacker-supplied image ever reaches libvips. Left for a future next release that widens the range.

Note on severity labels

GitHub's scope label is wrong on three of these alerts, which is worth knowing before triaging future rounds:

• chore(deps): bump formik from 2.4.6 to 2.4.9 #281 @vitest/browser (critical 9.4) is not runtime. GitHub labels it runtime; pnpm why -r shows it reachable only through devDependencies. It is a Browser Mode file-access permission bypass — a CI and local-dev concern, never the deployed container. The loudest number in this set is materially overstated.
• chore(deps): bump @sentry/nextjs from 10.24.0 to 10.25.0 in the sentry group #280 / DM-53194: Fix Dependabot auto merge #283 fast-uri are not dev-scope. GitHub labels them development; they arrive via ajv, a production dependency of apps/squareone used for config schema validation. These are the only two that genuinely reach deployed runtime code.

For context on real risk: no alert in this set exceeded 0.44% EPSS / 36th percentile, well under the ~1% "exploitation plausible" line. All are algorithmic-complexity DoS, build-time path traversal, or a local file-access gate. Nothing here was urgent; it is worth doing because it is cheap and the alerts will not clear themselves.

Validation steps

• pnpm run localci — 30/30 turbo tasks successful (biome format, prettier YAML, eslint, type-check, test, build across 14 packages), Docker/Biome-schema/theme-token validators pass, biome lint clean over 868 files.
• Verified resolved lockfile versions satisfy every advisory range listed above.
• Verified no peer-dependency regressions: the vitest family moves in lockstep at 4.1.10. The only remaining peer warning (react-a11y-disclosure vs React 19) is pre-existing on main.
• js-yaml@3.15.1 enters the tree as a side effect (pulled by read-yaml-file@1.1.0). Not flagged — the new js-yaml advisories apply to >= 4.0.0 only, and 3.15.1 postdates the 3.x code-injection fix.

References

• Security rounds report: rubin-maintenance reports/security-2026-08-01-squareone.md
• Alerts: https://github.com/lsst-sqre/squareone/security/dependabot
• Jira: https://rubinobs.atlassian.net/browse/DM-55688

[changeset-bot]

🦋 Changeset detected

Latest commit: d673082

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
squareone	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR