chore(all): batch transitive dependency upgrades for security alerts

[fefi95]

Closes #188
Closes #198

Parent tools are bumped first, then the lockfile is refreshed within existing ranges. No resolutions added. One commit per step. No published package's runtime dependencies changed: only devDependencies were edited.

Not covered here, because other PRs own them: js-yaml 4.x (#182), minimatch (#185), ip-address/socks (#186) and shell-quote (#187). Expect a yarn.lock conflict with whichever of these merges first.

Changes

Package	Old → New	How
turbo	1.12.4 → 2.11.8	parent bump
typedoc + plugins	0.25.8 → 0.28.20	parent bump
semantic-release	23.1.1 → 25.0.9	parent bump
mocha	11.8.0 → 12.0.3	parent bump (fixes serialize-javascript 6.0.2 → 7.1.2; mocha 11 pins ^6)
pacote, sigstore	19.0.2/20.0.1 → 21.5.1, 3.1.0 → 4.1.1	semantic-release bump
@isaacs/brace-expansion, browserslist, cross-spawn, glob@10	→ removed, 4.28.8, 7.0.6, 10.5.0	yarn dedupe
brace-expansion	→ 1.1.21 / 2.1.7 / 5.0.12	lockfile refresh within range
braces, compression, flatted, form-data, joi	→ 3.0.3, 1.8.2, 3.4.4, 4.0.6, 17.13.8	lockfile refresh within range
js-yaml@3, lodash, lodash-es, micromatch, picomatch, ws	→ 3.15.2, 4.18.1, 4.18.1, 4.0.8, 2.3.2/4.0.7, 7.5.13/8.22.0	lockfile refresh within range
http-cache-semantics, sprintf-js, elliptic, braces (new advisory), tmp	unchanged	justified below

Breaking changes handled

• turbo 2: three changes.
  • turbo.json moved from pipeline to tasks.
  • Turbo 2 has a built-in turbo docs command, so the root scripts now use turbo run <task>.
  • Turbo 2 hides environment variables from tasks by default. The release task now gets passThroughEnv for CI, GITHUB_*, GH_*, NPM_* and YARN_*; a dry run shows both release tokens reach it.
• typedoc 0.28 / markdown plugin 4: each member now gets its own page. The URLs the READMEs link to still resolve.
• semantic-release 25: needs Node ≥ 22.14. The release job uses .nvmrc (25.2.1), so this is fine. Release rules give the same results as before; yarn release was not run.
• yarn dedupe moved @types/react to 19, which drops the global JSX namespace. One native test fixture now uses ReactElement instead.

No upstream fix (for Vanta dismissal)

None of these is in the dependency tree of a published @assertive-ts/* package. They are all dev-only.

Package	Chain	Why it's unreachable at runtime
http-cache-semantics 4.1.1 (high, #180)	semantic-release → @semantic-release/npm → npm → make-fetch-happen	Only the npm CLI's single-user cache during CI publishing, not a shared cache. 4.3.0 does not fix the max-stale issue, so it wasn't used just to silence the alert.
sprintf-js 1.0.3 (moderate, #184)	jest / react-native → babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3 → argparse@1	Only formats help text when the test tooling reads a local coverage config. Every sprintf-js release is affected.
elliptic 6.6.1 (low, #162)	@assertive-ts/native (dev) → react-native-testing-mocks → rewiremock → node-libs-browser → crypto-browserify	These are browser polyfills that are never loaded, because the tests run on Node's built-in crypto.
braces 3.0.3 (high, GHSA-vfj7)	micromatch ← jest / metro / semantic-release	3.0.3 is the latest release. It only ever sees glob patterns from repo config.
tmp 0.0.33 (high)	all-contributors-cli → inquirer@7 → external-editor	The fix needs a 0.x major bump that the parent doesn't allow. all-contributors-cli never opens the editor prompt that would call tmp. Reviewer call: "external-editor/tmp": "^0.2.6" would close it.

Still open: moderate and low (follow-up)

• Moderate: @babel/runtime, @humanfs/node, @sinonjs/text-encoding, @testing-library/react-native, ajv, core-js, eslint, fast-xml-parser, glob@7/inflight, lodash.get, pbkdf2, postcss-selector-parser, qs, rimraf@3, whatwg-encoding
• Low: diff

All are dev-only.

Verification

• Run on Node 25.2.1 after yarn install --immutable, with the turbo cache bypassed.
• yarn build, yarn docs, yarn compile, yarn lint and yarn test all pass, with the same test counts as main.

yarn npm audit --all --recursive --severity high

├─ braces
│  ├─ ID: 1240992
│  ├─ Issue: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
│  ├─ URL: https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <=3.0.3
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.0.3
│  │ 
│  └─ Dependents
│     └─ micromatch@npm:4.0.8
│
├─ http-cache-semantics
│  ├─ ID: 1240991
│  ├─ Issue: http-cache-semantics max-stale handling can disclose cross-user cached responses
│  ├─ URL: https://github.com/advisories/GHSA-ch52-4w7c-c8xp
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <=4.2.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.1
│  │ 
│  └─ Dependents
│     └─ make-fetch-happen@npm:15.0.6
│
├─ js-yaml
│  ├─ ID: 1123911
│  ├─ Issue: js-yaml: YAML merge-key chains can force quadratic CPU consumption
│  ├─ URL: https://github.com/advisories/GHSA-52cp-r559-cp3m
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=4.0.0 <4.3.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.0
│  │ 
│  └─ Dependents
│     └─ semantic-release-yarn@npm:3.0.2 [41b58]
│
├─ js-yaml
│  ├─ ID: 1138115
│  ├─ Issue: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
│  ├─ URL: https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=4.0.0 <4.3.1
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.0
│  │ 
│  └─ Dependents
│     └─ semantic-release-yarn@npm:3.0.2 [41b58]
│
├─ js-yaml
│  ├─ ID: 1193727
│  ├─ Issue: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
│  ├─ URL: https://github.com/advisories/GHSA-2883-xcg3-v3hh
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=4.0.0 <4.3.2
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.0
│  │ 
│  └─ Dependents
│     └─ semantic-release-yarn@npm:3.0.2 [41b58]
│
├─ minimatch
│  ├─ ID: 1113459
│  ├─ Issue: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
│  ├─ URL: https://github.com/advisories/GHSA-3ppc-4f35-3m26
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <3.1.3
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.1.2
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-import@npm:2.32.0 [98c50]
│
├─ minimatch
│  ├─ ID: 1113465
│  ├─ Issue: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
│  ├─ URL: https://github.com/advisories/GHSA-3ppc-4f35-3m26
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=9.0.0 <9.0.6
│  │ 
│  ├─ Tree Versions
│  │  └─ 9.0.5
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-sonarjs@npm:3.0.5 [98c50]
│
├─ minimatch
│  ├─ ID: 1113538
│  ├─ Issue: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
│  ├─ URL: https://github.com/advisories/GHSA-7r86-cg39-jmmj
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <3.1.3
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.1.2
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-import@npm:2.32.0 [98c50]
│
├─ minimatch
│  ├─ ID: 1113544
│  ├─ Issue: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
│  ├─ URL: https://github.com/advisories/GHSA-7r86-cg39-jmmj
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=9.0.0 <9.0.7
│  │ 
│  ├─ Tree Versions
│  │  └─ 9.0.5
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-sonarjs@npm:3.0.5 [98c50]
│
├─ minimatch
│  ├─ ID: 1113546
│  ├─ Issue: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
│  ├─ URL: https://github.com/advisories/GHSA-23c5-xmqv-rm74
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <3.1.4
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.1.2
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-import@npm:2.32.0 [98c50]
│
├─ minimatch
│  ├─ ID: 1113552
│  ├─ Issue: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
│  ├─ URL: https://github.com/advisories/GHSA-23c5-xmqv-rm74
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=9.0.0 <9.0.7
│  │ 
│  ├─ Tree Versions
│  │  └─ 9.0.5
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-sonarjs@npm:3.0.5 [98c50]
│
├─ shell-quote
│  ├─ ID: 1241332
│  ├─ Issue: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
│  ├─ URL: https://github.com/advisories/GHSA-pqg4-j6r4-53mv
│  ├─ Severity: critical
│  ├─ Vulnerable Versions: >=1.8.4 <1.11.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 1.10.0
│  │ 
│  └─ Dependents
│     └─ react-devtools-core@npm:6.1.5
│
└─ tmp
   ├─ ID: 1120654
   ├─ Issue: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
   ├─ URL: https://github.com/advisories/GHSA-ph9p-34f9-6g65
   ├─ Severity: high
   ├─ Vulnerable Versions: <0.2.6
   │ 
   ├─ Tree Versions
   │  └─ 0.0.33
   │ 
   └─ Dependents
      └─ external-editor@npm:3.1.0

🤖 Generated with Claude Code

[rojasTob]

Hi @fefi95, thanks for batching these upgrades. Moving to Turbo 2 and clearing the transitive alerts in one go is really helpful.

I'm requesting changes for one item that I think will break the next real release. The rest are smaller and I've left them inline.

Blocking

• turbo.json: Turbo 2's strict env mode will likely keep the GitHub OIDC variables away from semantic-release. Every package publishes with "provenance": true, and provenance needs ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN. A dry run can't catch this, so it would only show up on the next workflow_dispatch release.

Non-blocking

• mocha 12 / semantic-release 25 need a newer Node than our root engines.node: ">=20" allows.
• @types/mocha is still on v10 while mocha is on v12.
• semantic-release jumps two majors (23 → 25, which brings commit-analyzer 13) and hasn't been run for real yet, so the scope-negation releaseRules are worth a quick check.
• The same five devDependency bumps are repeated in 4 packages plus examples/mocha. They could be hoisted to the root, but that can be a follow-up.

Pre-existing (not caused by this PR, FYI): the docs task's outputs: ["docs/*/build/**"] is resolved per package, but typedoc writes to ../../docs/<pkg>/build. So turbo caches no files, and after yarn clean a cache hit can leave docs/*/build empty. typedoc.json is also missing from inputs. It might be worth a follow-up issue, since this PR changes the typedoc majors.

---

🤖 Generated with Claude Code

[rojasTob]

Turbo 2 runs tasks in strict env mode, so anything not listed here (or in turbo's small built-in allowlist) is removed from the task's environment. All four packages publish with publishConfig.provenance: true, and release.yml grants id-token: write for that. Provenance needs ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN, and neither matches these globs. A dry run wouldn't catch this because nothing is published.

Suggested change

	"passThroughEnv": ["CI", "GITHUB_*", "GH_*", "NPM_*", "YARN_*"]
	"passThroughEnv": ["CI", "GITHUB_*", "GH_*", "NPM_*", "YARN_*", "ACTIONS_*", "RUNNER_*", "GIT_*", "SEMANTIC_RELEASE_*", "DEBUG"]

(DEBUG is so DEBUG=semantic-release:* still works for troubleshooting. Alternatively, "envMode": "loose" on just this task would avoid keeping an allowlist up to date.)

[rojasTob]

mocha@12 requires Node ^20.19.0 || >=22.12.0, and semantic-release@25 requires ^22.14.0 || >=24.10.0. The root engines.node is still >=20, so the engines plugin lets someone on Node 20.11 / 22.0 install and then fail with a confusing error in yarn test / yarn release. CI is fine because it resolves the latest 20/22/24. Should we raise the root engines.node to ^20.19.0 || >=22.12.0?

[rojasTob]

@types/mocha is still ^10.0.6 (10.0.6 in the lockfile) while the runtime is now mocha 12, so the tests type-check against an older API. Could we bump it together with mocha?

[rojasTob]

This is two majors of semantic-release (and commit-analyzer 12 → 13, @semantic-release/github → 12). Since yarn release wasn't run for real, could you double-check that the releaseRules scope negations in .releaserc.json (!core, !all, …) still match the same way under commit-analyzer 13? If not, the first release after merge could publish every package for a commit scoped to one package, or publish none.

[rojasTob]

The same mocha / semantic-release / typedoc* bumps are hand-edited in core, dom, native, sinon and examples/mocha. We could hoist them to the root devDependencies so the next upgrade is a single edit and can't drift. That's fine as a follow-up and doesn't need to be in this PR.