safe-global / safe-client-gateway / 29996844414

88%

push

github

Title: build(deps): bump transitive dependencies (#3295)

* fix(deps): resolve postcss to 8.5.15 to fix GHSA moderate advisory

postcss reached production via sanitize-html (^8.3.11) resolving to
8.5.3, which is affected by the moderate advisory fixed in 8.5.10
(Datadog SCA / GHSA advisory 1117015). Dedupe the ^8.3.11 range onto
the already-present 8.5.15 resolution (published 2026-05-19, past the
7-day age gate) which clears the advisory. No new package fetched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deps): bump brace-expansion 5.0.5 -> 5.0.7 to fix DoS advisories

The brace-expansion 5.x range reaches production via
@fastify/static -> glob@13 -> minimatch@10.2.5. Version 5.0.5 is
affected by two Datadog SCA findings: moderate 1120311 (fixed <5.0.6)
and high 1123898 (GHSA-3jxr-9vmj-r5cp, exponential-time expansion DoS,
fixed <5.0.7). Bump to 5.0.7 (published 2026-06-29, past the 7-day age
gate) to clear both. The brace-expansion 2.x range is a typeorm-subtree
transitive handled in a separate typeorm PR and is intentionally left
untouched here.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(deps): bump fast-uri 3.1.3 -> 3.1.4 to fix host-confusion advisory

fast-uri reaches production via fastify's ajv/fast-json-stringify
(@fastify/ajv-compiler, ajv, fast-json-stringify). Version 3.1.3 is
affected by the high-severity Datadog SCA finding 1124064
(GHSA-v2hh-gcrm-f6hx, host confusion via literal backslash authority
delimiter, fixed <=3.1.3 -> 3.1.4). The recent bump to 3.1.3 (#3288)
did not clear it; 3.1.4 is the minimum patched version.

NOTE: 3.1.4 was published 2026-07-19, i.e. below the repo's 7-day
npmMinimalAgeGate. It is pinned directly in the lockfile so immutable
CI installs honor it without re-resolving. If policy requires waiting
out the age gate, this commit can be deferred until 2026-07-26.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* build(deps)... (continued)

3685 of 4428 branches covered (83.22%)

Branch coverage included in aggregate %.

9563 of 10624 relevant lines covered (90.01%)

489.48 hits per line