fix(deps): patch high-risk dependency advisories

[Astro-Han]

Summary

Patch the current high-severity Dependabot alerts for pypdf and Astro, then close additional fixable high-severity findings exposed by the same dependency audit. There is no related product issue; the source is Dependabot alerts #88, #87, and #46 plus local Bun audit results.

Why

The repository pinned vulnerable parser, site, updater, packaging, router, CSS-processing, and glob-expansion dependencies. The affected versions include PDF infinite-loop, Host-header SSRF, credential-leak, arbitrary-file-read, DDoS, XSS, and native image-processing advisories.

Related Issue

None. This is driven by repository security alerts rather than a product issue.

Human Review Status

Pending

Review Focus

Please focus on the Astro 6 transitive security overrides, the Electron Builder 26.15.3 dependency-tree change, and the brace-expansion 5.0.8 CommonJS compatibility patch for the older minimatch callers retained by packaging and lint tooling.

Risk Notes

• sharp 0.35.3 is forced above Astro 6.4.6 optional range. The site does not use astro:assets, and a production site build passes, but this boundary should be revisited if the image pipeline is adopted.
• Electron packaging and updater dependencies affect both macOS and Windows. Targeted updater/config tests, desktop build, and a real macOS Electron startup passed; full signed installers remain CI/release coverage.
• brace-expansion is pinned to the only patched release, 5.0.8. Its CommonJS entry point has a narrow compatibility patch that preserves the callable export expected by minimatch 3, 5, and 9 while retaining the named expand export used by minimatch 10. A regression test exercises every installed minimatch release against the patched package.
• No visible UI or copy changed, so no screenshot is attached.

How To Verify

Root frozen install: 1361 installs across 1554 packages, no lockfile changes
Site frozen install + build: 256 installs, 2 static pages built
Site high/critical audit: 0 findings
Root high/critical audit: 0 findings
Brace-expansion compatibility: all installed minimatch 3/5/9/10 releases passed
PDF parser smoke: pypdf 6.14.2 and pdfplumber 0.11.4 both parsed an in-memory PDF
Desktop updater/config tests: 103 passed, 0 failed
Desktop typecheck: passed
Desktop production build: passed
Electron host smoke: PawWork window loaded, sidecar reached ready, no error dialog
Root lint: passed
Diff check: no whitespace errors

Screenshots or Recordings

Not applicable. This is dependency-only; the Electron development app was manually opened to the PawWork home surface as a host smoke check.

Checklist

How to use this checklist:

• Tick a box by replacing [ ] with [x]. Do not edit, add, or remove items.
• The bot-applied label items can only be honestly ticked AFTER the PR is opened and the labeler / priority-triage bots have run — return to the PR description and tick them then.
• Most items are required. The few that are conditional are explicitly marked (conditional); for those, leave unticked if they truly do not apply and explain why in Risk Notes. All other items must be ticked before requesting human review.

• Type label — this PR carries exactly one of bug, enhancement, task, documentation. Type labels are author-added; the labeler bot does NOT assign them. Add the label in the GitHub UI, then tick this.
• Routing labels — this PR carries at least one of app, ui, platform, harness, ci. The labeler bot assigns these on PR open based on changed paths. Confirm the bot choice (or override if wrong), then tick this.
• Priority label — this PR carries exactly one of P0, P1, P2, P3. The priority-triage bot suggests one on PR open. Confirm or override, then tick this.
• Human Review Status above is set to Pending, Approved by @<reviewer>, or Not required: <reason> (default is Pending; "not required" is restricted to bot-authored low-risk PRs).
• I linked the related issue, or stated in Summary why there is no issue.
• I described the review focus and any meaningful risks.
• I replaced the example block in How To Verify with the real verification steps and the key result for each.
• I did not introduce unrelated refactors, dependencies, generated files, or file changes beyond the stated scope.
• (conditional) I manually checked visible UI or copy changes when needed, with screenshots or recordings. Leave unticked only if no visible UI or copy changed.
• (conditional) I considered macOS and Windows impact for platform, packaging, updater, signing, paths, shell, or permissions changes. Leave unticked only if no platform/packaging surface was touched.
• (conditional) I called out docs, release notes, dependencies, permissions, credentials, deletion behavior, generated content, or local file changes when relevant. Leave unticked only if none of those surfaces was touched.
• I reviewed the final diff for unrelated changes and suspicious dependency changes.
• I am targeting dev, and my PR title and commit messages use Conventional Commits in English.

Summary by CodeRabbit

• Bug Fixes

  • Improved compatibility with brace-based file pattern matching across supported environments.
  • Preserved expected expansion behavior for patterns such as {a,b}.

• Updates

  • Updated desktop application packaging and update components for improved reliability.
  • Updated site tooling and related packages.
  • Updated PDF handling support for newer file formats and compatibility requirements.

• Tests

  • Added coverage to verify brace expansion works consistently across installed components.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes pin several dependencies, add a CommonJS compatibility patch for brace-expansion, add minimatch compatibility coverage, update Electron packaging tools, update site dependencies, and upgrade pypdf.

Changes

Brace expansion compatibility

Layer / File(s)	Summary
Brace expansion CommonJS patch package.json, patches/brace-expansion@5.0.8.patch	Pins brace-expansion@5.0.8 and restores a callable CommonJS export with named properties.
Minimatch compatibility validation packages/opencode/test/github/brace-expansion-compatibility.test.ts	Verifies all installed minimatch copies use brace-expansion@5.0.8 and preserve brace expansion results.

Desktop packaging dependencies

Layer / File(s)	Summary
Electron packaging version pins packages/desktop-electron/package.json	Pins electron-updater, electron-builder, and electron-builder-squirrel-windows versions.

Site dependency updates

Layer / File(s)	Summary
Astro and dependency overrides site/package.json	Updates Astro and pins js-yaml, postcss, sharp, and svgo.

Office PDF dependency update

Layer / File(s)	Summary
pypdf version update skills/office-pdf/pyproject.toml	Updates pypdf from 5.1.0 to 6.14.2.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels: desktop, windows

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: patching high-risk dependency advisories.
Description check	✅ Passed	The description follows the template and includes summary, why, related issue, review focus, risks, verification, and checklist items.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/high-risk-advisories-2026-07

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Suggested priority: P2 (includes non-doc, non-test paths outside the low-risk bucket).

P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.