fix(deps): patch high-risk dependency advisories

package.json

@@ -111,20 +111,24 @@
   "overrides": {
     "@types/bun": "catalog:",
     "@types/node": "catalog:",
+    "brace-expansion": "5.0.8",
     "@xmldom/xmldom": "0.8.13",
     "fast-uri": "3.1.4",
     "fastify": "5.8.5",
     "form-data": "4.0.6",
+    "find-my-way": "9.7.0",
     "hono": "catalog:",
     "esbuild": "0.28.1",
     "lodash": "4.18.1",
     "js-yaml": "4.3.0",
+    "postcss": "8.5.23",
     "sigstore": "4.1.1",
     "tar": "7.5.21",
     "ws": "8.21.0",
     "tmp": "0.2.7"
   },
   "patchedDependencies": {
-    "gray-matter@4.0.3": "patches/gray-matter@4.0.3.patch"
+    "gray-matter@4.0.3": "patches/gray-matter@4.0.3.patch",
+    "brace-expansion@5.0.8": "patches/brace-expansion@5.0.8.patch"
   }
 }

packages/desktop-electron/package.json

@@ -34,7 +34,7 @@
     "electron-context-menu": "4.1.2",
     "electron-log": "^5",
     "electron-store": "^10",
-    "electron-updater": "^6",
+    "electron-updater": "6.8.9",
     "electron-window-state": "^5.0.3",
     "marked": "^15",
     "qrcode": "1.5.4",
@@ -59,7 +59,8 @@
     "@typescript/native-preview": "catalog:",
     "@valibot/to-json-schema": "1.6.0",
     "electron": "40.10.3",
-    "electron-builder": "^26",
+    "electron-builder": "26.15.3",
+    "electron-builder-squirrel-windows": "26.15.3",
     "electron-vite": "^5",
     "sharp": "0.35.3",
     "solid-js": "catalog:",

packages/opencode/test/github/brace-expansion-compatibility.test.ts

@@ -0,0 +1,28 @@
+import { expect, test } from "bun:test"
+import { readdirSync } from "node:fs"
+import { createRequire } from "node:module"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+const repoRoot = fileURLToPath(new URL("../../../..", import.meta.url))
+const bunModulesRoot = path.join(repoRoot, "node_modules", ".bun")
+
+test("every minimatch release uses the patched brace-expansion without breaking brace globs", () => {
+  const minimatchInstalls = readdirSync(bunModulesRoot)
+    .filter((entry) => entry.startsWith("minimatch@"))
+    .sort()
+
+  expect(minimatchInstalls.length).toBeGreaterThan(0)
+
+  for (const install of minimatchInstalls) {
+    const minimatchPackage = path.join(bunModulesRoot, install, "node_modules", "minimatch", "package.json")
+    const requireFromMinimatch = createRequire(minimatchPackage)
+    const braceExpansionPackage = requireFromMinimatch("brace-expansion/package.json") as { version: string }
+    const minimatch = requireFromMinimatch("minimatch") as {
+      braceExpand: (pattern: string) => string[]
+    }
+
+    expect(braceExpansionPackage.version).toBe("5.0.8")
+    expect(minimatch.braceExpand("file-{a,b}.txt")).toEqual(["file-a.txt", "file-b.txt"])
+  }
+})

patches/brace-expansion@5.0.8.patch

@@ -0,0 +1,18 @@
+diff --git a/dist/commonjs/index.js b/dist/commonjs/index.js
+index be9df86be09c7655787a65c55ae6da01858894c3..28b14978349281f7a41f62ff3674c0d06e530308 100644
+--- a/dist/commonjs/index.js
++++ b/dist/commonjs/index.js
+@@ -260,4 +260,13 @@ function expand_(str, max, maxLength, isTop) {
+     }
+     return acc;
+ }
++// brace-expansion 5 switched its CommonJS entry point from a callable export
++// to named exports. Keep the secure implementation while remaining compatible
++// with minimatch 3, 5, and 9, which still call require('brace-expansion')
++// directly or through TypeScript's default-import helper.
++module.exports = Object.assign(expand, {
++    expand,
++    EXPANSION_MAX: exports.EXPANSION_MAX,
++    EXPANSION_MAX_LENGTH: exports.EXPANSION_MAX_LENGTH,
++});
+ //# sourceMappingURL=index.js.map

site/package.json

@@ -11,10 +11,14 @@
     "check": "astro check"
   },
   "dependencies": {
-    "astro": "6.4.2"
+    "astro": "6.4.6"
   },
   "overrides": {
     "esbuild": "0.28.1",
+    "js-yaml": "4.3.0",
+    "postcss": "8.5.23",
+    "sharp": "0.35.3",
+    "svgo": "4.0.2",
     "vite": "7.3.5"
   }
 }

skills/office-pdf/pyproject.toml

@@ -9,5 +9,5 @@ requires-python = ">=3.9"
 # printToPDF (see SKILL.md). Never add PyMuPDF / fitz here (AGPL).
 dependencies = [
   "pdfplumber==0.11.4",
-  "pypdf==5.1.0",
+  "pypdf==6.14.2",
 ]