[isadeks]

Clears the 8 OSV findings (2 packages) that osv-scanner reports on main. All 8 advisories were published on 2026-10-01, after #932 merged, so this isn't a regression. The advisory database changed under an unchanged lockfile.

Area

• tooling — root mise.toml, scripts, CI workflows

Related

Advisory	CVSS	Package	From → To	Lockfile(s)
GHSA-c475-qrg2-pj4r	8.2	basic-ftp	5.3.1 → 6.2.1	yarn.lock
GHSA-mcm9-63f2-9j32	8.2	devalue	5.9.2 → 5.9.4	yarn.lock
GHSA-r9w8-h9r3-54w4	8.2	devalue	5.9.2 → 5.9.4	same
GHSA-x5rw-q4pp-hg5g	8.2	devalue	5.9.2 → 5.9.4	same
GHSA-j22f-vq7h-c4qm	7.5	devalue	5.9.2 → 5.9.4	same
GHSA-4q55-j62x-fr9h	6.3	devalue	5.9.2 → 5.9.4	same
GHSA-hx4r-w6wj-j8fg	6.3	devalue	5.9.2 → 5.9.4	same
GHSA-wf3x-273g-mvxv	2.3	devalue	5.9.2 → 5.9.4	same

Changes

• Root package.json resolutions: added the floors devalue ^5.9.3 and basic-ftp ^6.2.1. Neither package is in jira-forge-app's lockfile, so no overrides mirror is needed, and check-transitive-pin-sync stays green.
• yarn.lock: re-resolved only these two entries, following the approach from fix(deps): clear 7 osv advisories blocking the merge queue #870 and fix(deps): clear urllib3, brace-expansion, fast-uri osv advisories #932.

devalue is transitive through astro (docs build). 5.9.4 sits inside astro's existing ^5.8.1 range, so this is a routine bump.

basic-ftp crosses a major version, so it needs a reviewer's look. It's transitive through get-uri ← pac-proxy-agent ← proxy-agent ← markdown-link-check / link-check / retire, which are dev tooling only and not shipped in any deployed artifact. No published get-uri accepts 6.x (latest 8.0.1 still pins ^5.3.1), so a forced resolution is the only fix today. The only 6.0.0 breaking change is that separate PASV transfer hosts are rejected by default, which hardens against FTP-bounce attacks. get-uri only calls access / lastMod / list / downloadTo, and none of those changed. Once get-uri widens its range, this pin can be dropped.

Verification: mise run security:deps (osv-scanner over all three lockfiles) reports No issues found. A full mise run build passes, including docs:build (which runs devalue), docs:link-check (which runs the basic-ftp path), and CDK 4783/4783 tests.

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@d34dc9e). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #935   +/-   ##
=======================================
  Coverage        ?   92.69%           
=======================================
  Files           ?      344           
  Lines           ?    99835           
  Branches        ?     9994           
=======================================
  Hits            ?    92538           
  Misses          ?     7297           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.