chore(all): batch transitive dependency upgrades for security alerts

[fefi95]

Closes #188
Closes #198

Parent tools are bumped first, then the lockfile is refreshed within existing ranges. No resolutions added. One commit per step. No published package's runtime dependencies changed: only devDependencies were edited.

Not covered here, because other PRs own them: js-yaml 4.x (#182), minimatch (#185), ip-address/socks (#186) and shell-quote (#187). Expect a yarn.lock conflict with whichever of these merges first. The parent bumps and the dedupe did shift some minimatch lockfile entries as a side effect (for example, ^9.0.4 moved from 9.0.5 to 9.0.9). This wasn't deliberate, and #185's targeted fix still applies.

Changes

Package	Old → New	How
turbo	1.12.4 → 2.11.8	parent bump
typedoc / typedoc-plugin-markdown / typedoc-plugin-merge-modules	0.25.8 → 0.28.20 / 3.17.1 → 4.14.0 / 5.1.0 → 7.0.0	parent bump
semantic-release	23.1.1 → 25.0.9	parent bump
mocha	11.8.0 → 12.0.3	parent bump (fixes serialize-javascript 6.0.2 → 7.1.2; mocha 11 pins ^6)
@types/mocha	10.0.6 → 10.0.10	latest published (no v11/v12 exists)
pacote, sigstore	19.0.2/20.0.1 → 21.5.1, 3.1.0 → 4.1.1	semantic-release bump
@isaacs/brace-expansion, browserslist, cross-spawn, glob@10	→ removed, 4.28.8, 7.0.6, 10.5.0	yarn dedupe
brace-expansion	→ 1.1.21 / 2.1.7 / 5.0.12	lockfile refresh within range
braces, compression, flatted, form-data, joi	→ 3.0.3, 1.8.2, 3.4.4, 4.0.6, 17.13.8	lockfile refresh within range
js-yaml@3, lodash, lodash-es, micromatch, picomatch, ws	→ 3.15.2, 4.18.1, 4.18.1, 4.0.8, 2.3.2/4.0.7, 7.5.13/8.22.0	lockfile refresh within range
http-cache-semantics, sprintf-js, elliptic, braces (new advisory), tmp	unchanged	justified below

Breaking changes handled

• turbo 2: three changes.
  • turbo.json moved from pipeline to tasks.
  • Turbo 2 has a built-in turbo docs command, so the root scripts now use turbo run <task>.
  • Turbo 2 hides environment variables from tasks by default. The release task now gets passThroughEnv for CI, GITHUB_*, GH_*, NPM_*, YARN_*, ACTIONS_*, RUNNER_*, GIT_*, SEMANTIC_RELEASE_* and DEBUG. A --dry=json run shows a set ACTIONS_ID_TOKEN_REQUEST_URL reaching the task (it was stripped before).
• typedoc 0.28 / markdown plugin 4: each member now gets its own page. The URLs the READMEs link to still resolve. SinonSpyAssertion and SinonSpyCallAssertion are type-only exports, so their pages move from classes/ to interfaces/. External links to the old pages will 404.
• mocha 12: it's ESM-only and needs Node ^20.19.0 || >=22.12.0. Root engines is tightened to match. .mocharc.json, --forbid-only and the test counts are unchanged.
• turbo docs task: caching is turned off. typedoc writes to ../../docs/<pkg>/build, outside the package, so the outputs glob matched nothing and a cache hit restored no docs.
• semantic-release 25: needs Node ≥ 22.14. The release job uses .nvmrc (25.2.1), so this is fine. The .releaserc.json rules give identical results under commit-analyzer 12 (main) and 13 (this PR) on the same sample commits. yarn release was not run.
• yarn dedupe moved @types/react to 19, which drops the global JSX namespace. One native test fixture now uses ReactElement instead.

No upstream fix (for Vanta dismissal)

None of these is in the dependency tree of a published @assertive-ts/* package. They are all dev-only, although Dependabot labels the alerts scope: runtime.

Package	Chain	Why it's unreachable at runtime
http-cache-semantics 4.1.1 (high, #180)	semantic-release → @semantic-release/npm → npm → make-fetch-happen; also Yarn's implicit node-gyp@10 → make-fetch-happen@13	The advisory only applies to shared caches, but both make-fetch-happen copies build their cache policy with shared: false (lib/cache/policy.js). Also, no .releaserc.json loads @semantic-release/npm, so semantic-release never runs that npm code. Note: 4.3.0 is outside the advisory's <=4.2.0 range and would close the alert, but its max-stale handling is unchanged, so this PR keeps 4.1.1 rather than close the alert without a fix.
sprintf-js 1.0.3 (moderate, #184)	jest / react-native → babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3 → argparse@1	js-yaml@3 requires argparse only from its CLI (bin/js-yaml.js); load-nyc-config uses the library, so argparse/sprintf-js are never loaded. Every sprintf-js release is affected.
elliptic 6.6.1 (low, #162)	@assertive-ts/native (dev) → react-native-testing-mocks → rewiremock → node-libs-browser → crypto-browserify	rewiremock loads node-libs-browser only when __webpack_require__ is defined; the tests run under mocha on Node, not webpack.
braces 3.0.3 (high, GHSA-vfj7)	micromatch ← jest / metro / semantic-release	3.0.3 is the latest release; no fix exists.
tmp 0.0.33 (high)	all-contributors-cli → inquirer@7 → external-editor	external-editor pins tmp@^0.0.33, so the fix needs a 0.x major. all-contributors-cli has no editor prompt (no editor reference in its dist). Reviewer call: "external-editor/tmp": "^0.2.6" would close it.

Still open: moderate and low (follow-up)

• Moderate, owned by other PRs: ip-address (Chore: bump ip-address to 10.7.4 and drop socks resolution #186) and js-yaml@4 (Chore: JS-yaml vulnerability #182)
• Moderate: @babel/runtime, @humanfs/node, @sinonjs/text-encoding, @testing-library/react-native, ajv, core-js, eslint, fast-xml-parser, glob@7/inflight, lodash.get, pbkdf2, postcss-selector-parser, qs, rimraf@3, whatwg-encoding
• Low: diff

All are dev-only.

Verification

• Run on Node 25.2.1 after yarn install --immutable, with the turbo cache bypassed, on the PR tip.
• yarn build, yarn docs, yarn compile, yarn lint and yarn test all pass, with the same test counts as main.

Notes for the release

• Watch the first manual Release run after merge. It is the first one under turbo 2 and semantic-release 25, and yarn release was not run here.
• publishConfig.provenance: true currently has no effect: the bundled Yarn 4.1.0 never reads the OIDC token (ACTIONS_ID_TOKEN does not appear in it), and npm view @assertive-ts/core dist.attestations is empty for published versions. The ACTIONS_* passthrough only matters once Yarn is upgraded.

yarn npm audit --all --recursive --severity high

├─ braces
│  ├─ ID: 1240992
│  ├─ Issue: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns
│  ├─ URL: https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <=3.0.3
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.0.3
│  │ 
│  └─ Dependents
│     └─ micromatch@npm:4.0.8
│
├─ http-cache-semantics
│  ├─ ID: 1240991
│  ├─ Issue: http-cache-semantics max-stale handling can disclose cross-user cached responses
│  ├─ URL: https://github.com/advisories/GHSA-ch52-4w7c-c8xp
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <=4.2.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.1
│  │ 
│  └─ Dependents
│     └─ make-fetch-happen@npm:15.0.6
│
├─ js-yaml
│  ├─ ID: 1123911
│  ├─ Issue: js-yaml: YAML merge-key chains can force quadratic CPU consumption
│  ├─ URL: https://github.com/advisories/GHSA-52cp-r559-cp3m
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=4.0.0 <4.3.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.0
│  │ 
│  └─ Dependents
│     └─ semantic-release-yarn@npm:3.0.2 [41b58]
│
├─ js-yaml
│  ├─ ID: 1138115
│  ├─ Issue: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
│  ├─ URL: https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=4.0.0 <4.3.1
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.0
│  │ 
│  └─ Dependents
│     └─ semantic-release-yarn@npm:3.0.2 [41b58]
│
├─ js-yaml
│  ├─ ID: 1193727
│  ├─ Issue: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
│  ├─ URL: https://github.com/advisories/GHSA-2883-xcg3-v3hh
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=4.0.0 <4.3.2
│  │ 
│  ├─ Tree Versions
│  │  └─ 4.1.0
│  │ 
│  └─ Dependents
│     └─ semantic-release-yarn@npm:3.0.2 [41b58]
│
├─ minimatch
│  ├─ ID: 1113459
│  ├─ Issue: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
│  ├─ URL: https://github.com/advisories/GHSA-3ppc-4f35-3m26
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <3.1.3
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.1.2
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-import@npm:2.32.0 [98c50]
│
├─ minimatch
│  ├─ ID: 1113465
│  ├─ Issue: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
│  ├─ URL: https://github.com/advisories/GHSA-3ppc-4f35-3m26
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=9.0.0 <9.0.6
│  │ 
│  ├─ Tree Versions
│  │  └─ 9.0.5
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-sonarjs@npm:3.0.5 [98c50]
│
├─ minimatch
│  ├─ ID: 1113538
│  ├─ Issue: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
│  ├─ URL: https://github.com/advisories/GHSA-7r86-cg39-jmmj
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <3.1.3
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.1.2
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-import@npm:2.32.0 [98c50]
│
├─ minimatch
│  ├─ ID: 1113544
│  ├─ Issue: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
│  ├─ URL: https://github.com/advisories/GHSA-7r86-cg39-jmmj
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=9.0.0 <9.0.7
│  │ 
│  ├─ Tree Versions
│  │  └─ 9.0.5
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-sonarjs@npm:3.0.5 [98c50]
│
├─ minimatch
│  ├─ ID: 1113546
│  ├─ Issue: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
│  ├─ URL: https://github.com/advisories/GHSA-23c5-xmqv-rm74
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <3.1.4
│  │ 
│  ├─ Tree Versions
│  │  └─ 3.1.2
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-import@npm:2.32.0 [98c50]
│
├─ minimatch
│  ├─ ID: 1113552
│  ├─ Issue: minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
│  ├─ URL: https://github.com/advisories/GHSA-23c5-xmqv-rm74
│  ├─ Severity: high
│  ├─ Vulnerable Versions: >=9.0.0 <9.0.7
│  │ 
│  ├─ Tree Versions
│  │  └─ 9.0.5
│  │ 
│  └─ Dependents
│     └─ eslint-plugin-sonarjs@npm:3.0.5 [98c50]
│
├─ shell-quote
│  ├─ ID: 1241332
│  ├─ Issue: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
│  ├─ URL: https://github.com/advisories/GHSA-pqg4-j6r4-53mv
│  ├─ Severity: critical
│  ├─ Vulnerable Versions: >=1.8.4 <1.11.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 1.10.0
│  │ 
│  └─ Dependents
│     └─ react-devtools-core@npm:6.1.5
│
└─ tmp
   ├─ ID: 1120654
   ├─ Issue: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
   ├─ URL: https://github.com/advisories/GHSA-ph9p-34f9-6g65
   ├─ Severity: high
   ├─ Vulnerable Versions: <0.2.6
   │ 
   ├─ Tree Versions
   │  └─ 0.0.33
   │ 
   └─ Dependents
      └─ external-editor@npm:3.1.0

🤖 Generated with Claude Code

[rojasTob]

Hi @fefi95, thanks for batching these upgrades. Moving to Turbo 2 and clearing the transitive alerts in one go is really helpful.

I'm requesting changes for one item that I think will break the next real release. The rest are smaller and I've left them inline.

Blocking

• turbo.json: Turbo 2's strict env mode will likely keep the GitHub OIDC variables away from semantic-release. Every package publishes with "provenance": true, and provenance needs ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN. A dry run can't catch this, so it would only show up on the next workflow_dispatch release.

Non-blocking

• mocha 12 / semantic-release 25 need a newer Node than our root engines.node: ">=20" allows.
• @types/mocha is still on v10 while mocha is on v12.
• semantic-release jumps two majors (23 → 25, which brings commit-analyzer 13) and hasn't been run for real yet, so the scope-negation releaseRules are worth a quick check.
• The same five devDependency bumps are repeated in 4 packages plus examples/mocha. They could be hoisted to the root, but that can be a follow-up.

Pre-existing (not caused by this PR, FYI): the docs task's outputs: ["docs/*/build/**"] is resolved per package, but typedoc writes to ../../docs/<pkg>/build. So turbo caches no files, and after yarn clean a cache hit can leave docs/*/build empty. typedoc.json is also missing from inputs. It might be worth a follow-up issue, since this PR changes the typedoc majors.

---

🤖 Generated with Claude Code

[rojasTob]

Turbo 2 runs tasks in strict env mode, so anything not listed here (or in turbo's small built-in allowlist) is removed from the task's environment. All four packages publish with publishConfig.provenance: true, and release.yml grants id-token: write for that. Provenance needs ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN, and neither matches these globs. A dry run wouldn't catch this because nothing is published.

Suggested change

	"passThroughEnv": ["CI", "GITHUB_*", "GH_*", "NPM_*", "YARN_*"]
	"passThroughEnv": ["CI", "GITHUB_*", "GH_*", "NPM_*", "YARN_*", "ACTIONS_*", "RUNNER_*", "GIT_*", "SEMANTIC_RELEASE_*", "DEBUG"]

(DEBUG is so DEBUG=semantic-release:* still works for troubleshooting. Alternatively, "envMode": "loose" on just this task would avoid keeping an allowlist up to date.)

[fefi95]

Applied your list in 8495f57. With ACTIONS_ID_TOKEN_REQUEST_URL=x turbo run release --dry=json, the variable now shows up in the release task's passthrough env; with the previous turbo.json it was dropped.

Related finding: provenance isn't in effect today. npm view @assertive-ts/core dist.attestations is empty for 2.0.0 and 2.1.0 (same for @assertive-ts/sinon), while it returns an attestation for e.g. semantic-release. And ACTIONS_ID_TOKEN doesn't appear anywhere in .yarn/releases/yarn-4.1.0.cjs. So the passthrough only matters once Yarn is upgraded. Noted in the PR description.

[rojasTob]

mocha@12 requires Node ^20.19.0 || >=22.12.0, and semantic-release@25 requires ^22.14.0 || >=24.10.0. The root engines.node is still >=20, so the engines plugin lets someone on Node 20.11 / 22.0 install and then fail with a confusing error in yarn test / yarn release. CI is fine because it resolves the latest 20/22/24. Should we raise the root engines.node to ^20.19.0 || >=22.12.0?

[fefi95]

Done in 257bdb0: root engines.node is now ^20.19.0 || >=22.12.0. The release job reads .nvmrc (25.2.1), which also satisfies semantic-release 25.

[rojasTob]

@types/mocha is still ^10.0.6 (10.0.6 in the lockfile) while the runtime is now mocha 12, so the tests type-check against an older API. Could we bump it together with mocha?

[fefi95]

Bumped to ^10.0.10 in all five packages (715c8b2). That's the latest @types/mocha on npm; there is no v11 or v12, and mocha 12.0.3 doesn't ship its own type definitions.

[rojasTob]

This is two majors of semantic-release (and commit-analyzer 12 → 13, @semantic-release/github → 12). Since yarn release wasn't run for real, could you double-check that the releaseRules scope negations in .releaserc.json (!core, !all, …) still match the same way under commit-analyzer 13? If not, the first release after merge could publish every package for a commit scoped to one package, or publish none.

[fefi95]

Checked by running analyzeCommits from commit-analyzer 12.0.0 (main's lockfile) and 13.0.1 (this PR) with the packages/core/.releaserc.json rules on the same commits. Results are identical:

Commit	12.0.0	13.0.1
feat(core), fix(core), feat(dom), feat(all), chore(all)	no release	no release
feat:	minor	minor
fix:	patch	patch
feat(core)!: + BREAKING CHANGE	major	major

Unchanged by this PR, but worth knowing: with these rules a scoped feat(core) / fix(core) doesn't trigger a release on either version.

[rojasTob]

The same mocha / semantic-release / typedoc* bumps are hand-edited in core, dom, native, sinon and examples/mocha. We could hoist them to the root devDependencies so the next upgrade is a single edit and can't drift. That's fine as a follow-up and doesn't need to be in this PR.

[fefi95]

Agreed, leaving the hoisting for a follow-up so this PR stays scoped to the alerts.