build(deps): fix 13 security advisories (tar, brace-expansion, js-yaml, hono, fast-uri, body-parser)

[humble-little-bear]

Summary

Security dependency bumps clearing 13 of the 15 advisories currently reported for pnpm-lock.yaml (8 open Dependabot alerts + additional ones found via pnpm audit). All changes are patch/minor-level, applied via the existing pnpm-workspace.yaml override pattern plus one direct-dependency floor bump.

Fixed

Package	From → To	Severity	Advisory	Dependabot alert
tar	^7.5.3 (7.5.16) → ^7.5.19 (7.5.21)	Critical	GHSA-23hp-3jrh-7fpw — Decompression/parse DoS via unlimited input	#315
tar	7.5.16 → 7.5.21	High	GHSA-8x88-c5mf-7j5w — Negative tar entry size causes infinite loop	#314
tar	7.5.16 → 7.5.21	Moderate	GHSA-w8wr-v893-vjvp — Process crash via PAX numeric path type confusion	#316
tar	7.5.16 → 7.5.21	Moderate	GHSA-gvwx-54wh-qm9j — Uncaught exception DoS via NUL byte in PAX records	#313
brace-expansion	1.1.13 → 1.1.16	High	GHSA-3jxr-9vmj-r5cp — Exponential-time expansion DoS	#311
brace-expansion	5.0.6 → 5.0.7	High	GHSA-3jxr-9vmj-r5cp — Exponential-time expansion DoS	#310
js-yaml	4.2.0 → 4.3.0	High	GHSA-52cp-r559-cp3m — YAML merge-key chains quadratic CPU	#312
hono	4.12.25 → 4.12.27	Moderate (dev-only)	GHSA-xgm2-5f3f-mvvc, GHSA-hvrm-45r6-mjfj, GHSA-w62v-xxxg-mg59	not yet opened
fast-uri	3.1.2 → 3.1.4	High (dev-only)	GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6 — host confusion	not yet opened
body-parser	2.2.2 → 2.3.0	Low (dev-only)	GHSA-v422-hmwv-36x6 — invalid limit disables size enforcement	auto-dismissed

minimumReleaseAgeExclude was extended for the freshly published versions, matching the existing convention.

Not auto-fixed

Package	Advisory	Reason
elliptic 6.6.1	GHSA-848j-6mx2-7j84 (Low, alert #169)	No patched release published — 6.6.1 is the latest version on npm (the audit DB's >=6.6.2 fix version does not exist). Transitive via @ckb-ccc/core → @joyid/ckb → @nervosnetwork/ckb-sdk-utils. Needs an upstream fix.
@hono/node-server 1.19.13	GHSA-frvp-7c67-39w9 (Moderate)	Fix exists only in ≥2.0.5 — a breaking major bump that violates @modelcontextprotocol/sdk@1.27.1's declared ^1.19.9 range, so forcing it via override could silently break the (dev-only, Windows-only) eslint --mcp static-serving path. Left for a deliberate upgrade.

Verification

• pnpm install — lockfile regenerated cleanly
• pnpm audit — 15 → 2 advisories remaining (the two listed above); 0 critical / 0 high left
• pnpm build ✅
• pnpm test — 24/24 suites, 181 passed ✅
• pnpm typecheck ✅ / pnpm lint ✅ (0 errors)

[github-actions]

❌ Missing Changeset

Please add a changeset describing your changes:

pnpm changeset

If your changes do not need a version bump (docs, CI, refactoring),
add the skip-changeset label to this PR.

For dependency updates, use the dependencies label.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f37c4018-0908-4454-88b4-1b44f2d18f71

📥 Commits

Reviewing files that changed from the base of the PR and between 1a362aa and ed05881.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• package.json
• pnpm-workspace.yaml

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Applied security updates to improve protection against known vulnerabilities.
  • Updated package version safeguards to ensure supported, more secure components are used.
  • Refined release controls for improved consistency and reliability during installations and updates.

Walkthrough

Updates the tar dependency, expands workspace security overrides for several packages, and synchronizes minimum release age exclusions with the new pinned versions.

Changes

Dependency security updates

Layer / File(s)	Summary
Dependency and override pins package.json, pnpm-workspace.yaml	The direct tar dependency and workspace security overrides are updated to newer patched versions, including hono, brace-expansion, and js-yaml.
Release-age exclusion alignment pnpm-workspace.yaml	Minimum release age exclusions are updated for the revised pins and additional packages including tar, hono, fast-uri, and body-parser.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: dependencies

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main dependency security fixes in the changeset.
Description check	✅ Passed	The description matches the security dependency bumps and remaining advisory notes in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

pnpm-workspace.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}