fix(deps): bump stale overrides to patched versions

[mrwogu]

Description

We had 20 open Dependabot alerts (1 critical, 7 high). All of them are transitive, so Dependabot could not fix them by itself, the update job ended with security_update_not_possible. For example axios 1.18.1 comes from nx 23.2.1, which is already the latest nx.

Most of these packages already had an override in pnpm-workspace.yaml, but pinned exact versions that are vulnerable again now (axios@1.16.0: 1.18.0, undici@6.26.0: 6.28.0 and so on). So I changed them to ranges inside the same major, then the next patch is picked up without a new exact pin:

• @xhmikosr/decompress -> ^11.1.4 (critical)
• axios -> ^1.20.0
• undici 6.x -> ^6.28.1
• brace-expansion -> ^1.1.21, ^2.1.7, ^5.0.12
• fast-uri 4.x -> ^4.1.5 (the 3.x override stays)
• js-yaml 5.x -> ^5.4.1, new entry
• qs -> ^6.16.0, this one was not in the GitHub alerts but pnpm audit showed it, it comes from @vscode/vsce

js-yaml 5 is only pulled by verdaccio (dev tooling), our config loading does not use it. The rest is also dev and build tooling.

Related Issue

No issue, Dependabot alerts.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Checklist

• My code follows the project's coding standards
• I have added tests that prove my fix/feature works
• All new and existing tests pass
• I have updated the documentation accordingly

Screenshots (if applicable)

Additional Notes

pnpm audit says "No known vulnerabilities found" after the change. Format, lint, typecheck, validate, schema, skill and grammar checks pass, cli build too.

Local test run had a few 5s timeouts, but different tests every time and clean main failed the same way, my machine was under heavy load (load avg 34). managed-output-worker.spec.ts alone passes 19/19. I leave it to CI.

Summary by CodeRabbit

• Chores
  • Updated version ranges for several underlying components to include newer releases. Other override settings remain unchanged. These updates may be included when installing or refreshing the workspace’s software.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: mrwogu/promptscript/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: e733b486-a778-47cf-9216-3abcb2b53859

📥 Commits

Reviewing files that changed from the base of the PR and between a426289 and 2816436.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

Workspace dependency overrides now use version ranges for selected packages. The changes update matching ranges for decompress, Axios, brace-expansion, fast-uri, js-yaml, qs, and Undici.

Changes

Dependency overrides

Layer / File(s)	Summary
Update dependency override ranges pnpm-workspace.yaml	Overrides for decompress, Axios, brace-expansion, fast-uri, js-yaml, qs, and Undici now use version ranges that resolve to patched releases. The existing fast-uri range for versions below 3.1.6 remains.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 28164

The dependency overrides and lockfile are consistent, with no concrete merge-blocking issue established. Proceed with the normal CI checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 28164

The change affects 1 system.

Changed systems: pnpm-workspace.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — pnpm-workspace.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in pnpm-workspace.yaml: Dependency overrides now match version ranges for decompress, Axios, brace-expansion, fast-uri, js-yaml, qs, and Undici and resolve them to patched releases. This replaces the prior exact-version overrides for decompress, Axios, brace-expansion, qs, and Undici; brace-expansion also gains a 1.x range. Existing fast-uri <3.1.6 coverage remains, and the new fast-uri override covers >=4.0.0 <4.1.5.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating stale dependency overrides to patched versions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Bundle Report

Changes will increase total bundle size by 553 bytes (0.02%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
promptscript-cli	2.53MB	553 bytes (0.02%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: promptscript-cli

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
index.js	553 bytes	2.24MB	0.02%

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!