fix(deps): clear high-severity audit findings

package.json

@@ -112,15 +112,19 @@
     "@types/bun": "catalog:",
     "@types/node": "catalog:",
     "@xmldom/xmldom": "0.8.13",
-    "fast-uri": "3.1.2",
+    "fast-uri": "3.1.4",
     "fastify": "5.8.5",
     "form-data": "4.0.6",
     "hono": "catalog:",
     "esbuild": "0.28.1",
     "lodash": "4.18.1",
+    "js-yaml": "4.3.0",
     "sigstore": "4.1.1",
+    "tar": "7.5.21",
     "ws": "8.21.0",
     "tmp": "0.2.7"
   },
-  "patchedDependencies": {}
+  "patchedDependencies": {
+    "gray-matter@4.0.3": "patches/gray-matter@4.0.3.patch"
+  }
 }

packages/app/package.json

@@ -42,7 +42,7 @@
     "@types/node": "catalog:",
     "@types/sortablejs": "1.15.9",
     "@typescript/native-preview": "catalog:",
-    "sharp": "0.34.5",
+    "sharp": "0.35.3",
     "typescript": "catalog:",
     "vite": "catalog:",
     "vite-plugin-icons-spritesheet": "3.0.1",

packages/desktop-electron/package.json

@@ -61,7 +61,7 @@
     "electron": "40.10.3",
     "electron-builder": "^26",
     "electron-vite": "^5",
-    "sharp": "0.34.5",
+    "sharp": "0.35.3",
     "solid-js": "catalog:",
     "sury": "11.0.0-alpha.4",
     "typescript": "~5.6.2",

packages/opencode/package.json

@@ -159,7 +159,7 @@
     "pdfjs-dist": "5.6.205",
     "remeda": "catalog:",
     "semver": "^7.6.3",
-    "sharp": "0.34.5",
+    "sharp": "0.35.3",
     "solid-js": "catalog:",
     "strip-ansi": "7.1.2",
     "tree-sitter-bash": "0.25.0",

packages/opencode/test/config/markdown.test.ts

@@ -1,4 +1,5 @@
 import { expect, test, describe } from "bun:test"
+import matter from "gray-matter"
 import { ConfigMarkdown } from "../../src/config"
 
 describe("ConfigMarkdown: normal template", () => {
@@ -171,6 +172,14 @@ describe("ConfigMarkdown: frontmatter parsing", async () => {
   })
 })
 
+test("gray-matter parses and stringifies frontmatter with the patched js-yaml API", () => {
+  const source = matter.stringify("Body", { name: "test" })
+  const parsed = matter(source)
+
+  expect(parsed.data.name).toBe("test")
+  expect(parsed.content.trim()).toBe("Body")
+})
+
 describe("ConfigMarkdown: frontmatter parsing w/ empty frontmatter", async () => {
   const result = await ConfigMarkdown.parse(import.meta.dir + "/fixtures/empty-frontmatter.md")
 

patches/gray-matter@4.0.3.patch

@@ -0,0 +1,24 @@
+diff --git a/lib/engines.js b/lib/engines.js
+index 38f993db06cf364191ac635a6590c2d29303297d..1dfec8d9527653ad9ccfaacfa59732246fdb1e32 100644
+--- a/lib/engines.js
++++ b/lib/engines.js
+@@ -15,4 +15,4 @@
+ engines.yaml = {
+-  parse: yaml.safeLoad.bind(yaml),
+-  stringify: yaml.safeDump.bind(yaml)
++  parse: yaml.load.bind(yaml),
++  stringify: yaml.dump.bind(yaml)
+ };
+diff --git a/package.json b/package.json
+index c5a1fff7587dd332d26865381eeaf76ef425eb80..3ba2e022b0c31b5ad49be6fe0139ace4a68f90aa 100644
+--- a/package.json
++++ b/package.json
+@@ -34,7 +34,7 @@
+     "test": "mocha"
+   },
+   "dependencies": {
+-    "js-yaml": "^3.13.1",
++    "js-yaml": "^4.3.0",
+     "kind-of": "^6.0.2",
+     "section-matter": "^1.0.0",
+     "strip-bom-string": "^1.0.0"