[sidhommoez]

Summary

The repo has 14 open Dependabot alerts. Six are fast-uri, a runtime dependency through ajv, and the blocking production audit in CI now fails on it, so main itself no longer passes the Security Audit job. Dependabot's own fast-uri bump, xarf/xarf-javascript#43, fails every job because its lockfile does not satisfy npm ci on CI's npm 10.8.2.

The cause of that failure is the scoped eslint-plugin-sonarjs > minimatch override. npm 11 carries it into eslint through sonarjs's eslint peer dependency. It then drops eslint's own minimatch 3.x entries from the lock, and npm 10's npm ci reports them as missing. This PR replaces that override with a minimatch@^10 key, which only matches requests for minimatch 10.x. It also raises the vulnerable packages to their patched versions with a targeted lock update.

The same versions also clear advisories that have no open alert here. Nine are the dev-only alerts Dependabot auto-dismissed, for tar, brace-expansion and browserslist. The others were published after 2026-09-13, the date of the newest alert in this repo. They are two more for fast-uri, three more for brace-expansion, and three for handlebars, two of them critical, published 2026-10-08.

Not done: braces GHSA-vfj7-8cjw-p6xm has no patched release. It comes in through jest 29 and ts-prune, both dev-only, and has no Dependabot alert. All 33 entries left in the full npm audit trace to it, and that CI step is informational. Removing it would need jest 30 and dropping ts-prune, which is unmaintained. That is a separate decision.

Changes

• package.json overrides:
  • fast-uri ^3.1.2 → ^3.1.8
  • js-yaml ^4.2.0 → ^4.3.2
  • eslint-plugin-sonarjs > minimatch ^10.2.3 → "minimatch@^10": "^10.2.6". sonarjs 3.x still pins the vulnerable minimatch@10.1.2, so the override is still needed.
• package.json devDependencies: tar ^7.5.2 → ^7.5.22.
• package-lock.json: a targeted update, so only these packages move.

Package	Before	After	Reached through
fast-uri	3.1.2	3.1.8	ajv (runtime)
js-yaml	4.2.0	4.3.2	eslint, jest coverage
tar	7.5.16	7.5.22	direct (scripts/fetch-schemas.js)
brace-expansion	1.1.15, 5.0.6	1.1.21, 5.0.12	minimatch
minimatch 10.x	10.2.5	10.2.6	sonarjs, typescript-estree
handlebars	4.7.9	4.7.10	ts-jest
browserslist	4.28.4	4.29.3	babel, via ts-jest
baseline-browser-mapping	2.10.38	2.11.28	browserslist

browserslist's data packages also moved with it: caniuse-lite, electron-to-chromium, node-releases and update-browserslist-db.

Test Plan

• CI jobs reproduced in Docker with the same Node and npm versions CI uses:
  • Node 20.20.2 / npm 10.8.2: npm ci, lint, format:check, typecheck, build, npm audit --omit=dev --audit-level=high and npm test -- --coverage all pass.
  • Node 18.20.8 / npm 10.8.2 and Node 22.23.2 / npm 10.9.8: npm ci and npm test -- --coverage pass.
  • 229 of 229 tests pass with 96.5% statement coverage, the same as main.
• Control run on main: everything passes except the blocking production audit, which fails on fast-uri.
• Lock stability: npm install --package-lock-only leaves the new lock unchanged under npm 10.8.2, 10.9.8, 11.11.1 and 12.2.0. So does a Dependabot-style npm update fast-uri under npm 11.
• Reproduced the ci(deps): bump fast-uri from 3.1.2 to 3.1.4 in the npm_and_yarn group across 1 directory #43 failure from main. npm 11 regenerates the lock after the fast-uri bump alone, then npm ci on npm 10.8.2 fails with Missing: minimatch@3.1.5 from lock file.
• Each of the 14 open alerts was checked with semver against every copy of its package in the new lock. None is still in a vulnerable range. On main's lock, all 14 are.
• fast-uri behaviour: I recorded every fast-uri call ajv makes during the full test suite, 32,272 calls of which 151 are unique. I replayed each one against 3.1.2 and 3.1.8. The results are identical.
• tar: npm run fetch-schemas && npm run generate-schemas with tar 7.5.22 regenerates src/schemas.generated.ts byte for byte.
• Local npm ci with npm 11.11.1 now succeeds. On main it fails.
• GitHub Actions CI on this PR.
• After merge: the 14 Dependabot alerts close.

Risk & Rollback

Only this repo's dev toolchain and lockfile change. overrides and devDependencies are not applied when consumers install @xarf/xarf, and its published dependencies are unchanged. Consumers resolve fast-uri through ajv's ^3.0.1, so a fresh install already gets 3.1.8. No release is needed for the alerts to close. Rollback is git revert.

Linked Issues

Fixes ENG-1116
Supersedes xarf/xarf-javascript#43