Unleash / unleash / 29926722209

87%

master: 91%

push

github

fix: resolve Dependabot npm vulnerabilities

## Summary
- Updates vulnerable npm dependencies reported by Dependabot across the
root and standalone OSS pnpm lockfiles.
- Adds focused pnpm overrides for vulnerable transitive packages where
parent upgrades do not naturally lift the resolved version.
- Updates the direct `js-yaml` dependency and enterprise override to
`4.3.0`.
- Keeps release-age quarantine exceptions limited to the security patch
versions that are still within the 7-day window after a supply-chain
review.

## Security updates
This resolves vulnerable resolved versions for packages including
`axios`, `body-parser`, `brace-expansion`, `fast-uri`, `hono`,
`@hono/node-server`, `@opentelemetry/propagator-jaeger`, `immutable`,
`js-yaml`, `linkify-it`, `protobufjs`, `shell-quote`, and
`systeminformation`.

## Supply-chain review
- Removed release-age exceptions for packages already older than the
workspace quarantine window.
- Kept only `@hono/node-server@2.0.10` and `fast-uri@3.1.4` as temporary
release-age exceptions.
- Checked npm registry metadata for the exception versions: package
integrity/signatures are present, maintainer and repository lineage are
consistent, and dry-run tarball inspection showed no install hooks,
bins, or bundled dependencies.
- `@hono/node-server@2.0.10` has npm provenance attestation;
`fast-uri@3.1.4` does not, so it should be removed from the exception
list once it ages out.

1962 of 2164 branches covered (90.67%)

15655 of 17925 relevant lines covered (87.34%)

845.88 hits per line