Skip to content

fix(deps): resolve OSV scanner vulnerabilities - #2032

Merged
ya7010 merged 1 commit into
mainfrom
ya7010/fix-actions-run-30137315473
Jul 25, 2026
Merged

fix(deps): resolve OSV scanner vulnerabilities#2032
ya7010 merged 1 commit into
mainfrom
ya7010/fix-actions-run-30137315473

Conversation

@ya7010

@ya7010 ya7010 commented Jul 25, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • update the npm packages reported by OSV Scanner run 30137315473
  • upgrade vscode-languageclient to a minimatch 10-compatible release
  • patch serve-handler's CommonJS minimatch import because no compatible upstream release is available
  • regenerate pnpm-lock.yaml with all eight reported vulnerabilities removed

Verification

  • OSV Scanner v2.3.8: 1,123 packages scanned, 0 vulnerabilities
  • CI=true pnpm install --frozen-lockfile
  • cargo fmt --all --check
  • pnpm -C editors/vscode run format:check
  • pnpm -C editors/vscode run lint:check
  • pnpm -C editors/vscode run typecheck
  • pnpm -C editors/vscode run test (9 tests)
  • pnpm -C editors/vscode run build
  • pnpm -C docs run lint:check
  • pnpm -C docs run build (43 prerendered routes)
  • serve-handler HTTP smoke test
  • git diff --check

Related run

@ya7010 ya7010 added bug Something isn't working dependencies Pull requests that update a dependency file labels Jul 25, 2026
@ya7010
ya7010 merged commit b62a8a3 into main Jul 25, 2026
23 checks passed
@ya7010
ya7010 deleted the ya7010/fix-actions-run-30137315473 branch July 25, 2026 01:26
@BrewTestBot BrewTestBot mentioned this pull request Jul 31, 2026
Merged
This was referenced Aug 3, 2026
Closed
Merged
jylenhof pushed a commit to jylenhof/gh-action-pulse that referenced this pull request Aug 4, 2026
@ghappforreleaseplease @github-actions
chore(mise): upgrade tombi (#122)
3ee94ae 
Automated mise tool upgrades from local config.

Updated tools:
- `tombi`

Command: `mise upgrade --bump --local tombi`

<details>
<summary>Version changelog (tombi)</summary>

| Tool | Requested | Installed |
|------|-----------|-----------|
| `tombi` | `1.2.4` → `1.2.6` | `1.2.4` → `1.2.6` |

</details>

<details>
<summary>Release notes (1 tools)</summary>

<details>
<summary>tombi: `1.2.4` → `1.2.6` (tombi-toml/tombi)</summary>

### v1.2.5

<!-- Release notes generated using configuration in .github/release.yml at v1.2.5 -->

## What's Changed
### 🦅 New Features
* feat(intellij): download tombi when unavailable by @​ya7010 in tombi-toml/tombi#2033
* feat(installer): add PowerShell installer by @​ya7010 in tombi-toml/tombi#2037
* feat(formatter): add key quote style option by @​ya7010 in tombi-toml/tombi#2047
### 🐝 Bug Fixes
* fix(docs): match overscroll background to theme by @​ya7010 in tombi-toml/tombi#2026
* fix(deps): update packages flagged by OSV scanner by @​ya7010 in tombi-toml/tombi#2027
* fix(parser): prevent stack overflows from deeply nested values by @​ya7010 in tombi-toml/tombi#2029
* fix(deps): resolve OSV scanner vulnerabilities by @​ya7010 in tombi-toml/tombi#2032
* fix: restore README package badges by @​ya7010 in tombi-toml/tombi#2039
* fix(vscode): restore extension packaging with minimatch 10 by @​ya7010 in tombi-toml/tombi#2040
* fix: replace retired VS Code Marketplace badge by @​ya7010 in tombi-toml/tombi#2041
* fix(zed): disable unsupported doctests by @​ya7010 in tombi-toml/tombi#2044
### 🛠️ Other Changes
* chore: normalize line endings by @​ya7010 in tombi-toml/tombi#2030
* chore(ci): update actions/checkout to v7 by @​xtqqczze in tombi-toml/tombi#2028
* fix(docs): improve search result highlighting by @​ya7010 in tombi-toml/tombi#2031
* Revert "feat(intellij): download tombi when unavailable" by @​ya7010 in tombi-toml/tombi#2036
* feat(intellij): Register Marketplace error reporter by @​InSyncWithFoo in tombi-toml/tombi#2035

**Full Changelog**: https://github.com/tombi-toml/tombi/… (truncated)

### v1.2.6

<!-- Release notes generated using configuration in .github/release.yml at v1.2.6 -->

## What's Changed
### 🦅 New Features
* feat(docs): synchronize code tab selections by @​ya7010 in tombi-toml/tombi#2053
### 🐝 Bug Fixes
* fix(docs): preserve interactions across navigation by @​ya7010 in tombi-toml/tombi#2051
* fix(docs): restore typecheck by @​ya7010 in tombi-toml/tombi#2052
### 🛠️ Other Changes
* feat(lsp): add multi-line string completion suggestions by @​ya7010 in tombi-toml/tombi#2055

**Full Changelog**: tombi-toml/tombi@v1.2.5...v1.2.6

</details>

</details>

Modified files:
- `.mise.toml`

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
social4hyq pushed a commit to social4hyq/homebrew-core that referenced this pull request Sep 20, 2026
HarmonybrewBot HarmonybrewBot
!15617 merge bump-tombi-1.2.5 into main
cfcc3c4 
tombi 1.2.5

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre><!-- Release notes generated using configuration in .github/release.yml at v1.2.5 -->

## What's Changed
### 🦅 New Features
* feat(intellij): download tombi when unavailable by @ya7010 in tombi-toml/tombi#2033
* feat(installer): add PowerShell installer by @ya7010 in tombi-toml/tombi#2037
* feat(formatter): add key quote style option by @ya7010 in tombi-toml/tombi#2047
### 🐝 Bug Fixes
* fix(docs): match overscroll background to theme by @ya7010 in tombi-toml/tombi#2026
* fix(deps): update packages flagged by OSV scanner by @ya7010 in tombi-toml/tombi#2027
* fix(parser): prevent stack overflows from deeply nested values by @ya7010 in tombi-toml/tombi#2029
* fix(deps): resolve OSV scanner vulnerabilities by @ya7010 in tombi-toml/tombi#2032
* fix: restore README package badges by @ya7010 in tombi-toml/tombi#2039
* fix(vscode): restore extension packaging with minimatch 10 by @ya7010 in tombi-toml/tombi#2040
* fix: replace retired VS Code Marketplace badge by @ya7010 in tombi-toml/tombi#2041
* fix(zed): disable unsupported doctests by @ya7010 in tombi-toml/tombi#2044
### 🛠️ Other Changes
* chore: normalize line endings by @ya7010 in tombi-toml/tombi#2030
* chore(ci): update actions/checkout to v7 by @xtqqczze in tombi-toml/tombi#2028
* fix(docs): improve search result highlighting by @ya7010 in tombi-toml/tombi#2031
* Revert "feat(intellij): download tombi when unavailable" by @ya7010 in tombi-toml/tombi#2036
* feat(intellij): Register Marketplace error reporter by @InSyncWithFoo in tombi-toml/tombi#2035


**Full Changelog**: https://github.com/tombi-toml/tombi/compare/v1.2.4...v1.2.5</pre>
  <p>View the full release notes at <a href="https://github.com/tombi-toml/tombi/releases/tag/v1.2.5">https://github.com/tombi-toml/tombi/releases/tag/v1.2.5</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!15617
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bug Something isn't working dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ya7010