fix(deps): eliminate npm audit vulnerabilities

.github/workflows/ci.yml

@@ -231,6 +231,10 @@ jobs:
         if: steps.plan.outputs.code == 'true' || steps.plan.outputs.astryx_surface == 'true' || steps.plan.outputs.asf_source == 'true' || steps.plan.outputs.cli_package == 'true' || steps.plan.outputs.release_contract == 'true'
         run: npm ci
 
+      - name: Test dependency workspace adapter
+        if: steps.plan.outputs.code == 'true'
+        run: node --test scripts/find-workspace-root.test.mjs
+
       - name: Check localized TUI copy boundaries
         if: steps.plan.outputs.code == 'true'
         run: |

apps/desktop/package.json

@@ -92,7 +92,7 @@
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-web-links": "0.12.0",
     "@xterm/xterm": "^6.0.0",
-    "electron": "43.4.1",
+    "electron": "43.5.0",
     "electron-builder": "26.17.0",
     "esbuild": "^0.28.1",
     "linkedom": "^0.18.13",

apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt

@@ -8807,7 +8807,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 ================================================================================
 
-Package: dompurify@3.4.13
+Package: dompurify@3.4.16
 Declared license: (MPL-2.0 OR Apache-2.0)
 Selected license: Apache-2.0
 Repository: git://github.com/cure53/DOMPurify.git

package.json

@@ -122,6 +122,7 @@
     "@electron/asar": "4.3.0",
     "@types/node": "^26.6.3",
     "esbuild": "^0.28.1",
+    "find-yarn-workspace-root": "file:scripts/npm-compat/find-workspace-root",
     "husky": "^9.1.7",
     "knip": "^6.38.0",
     "patch-package": "8.0.1",
@@ -134,6 +135,9 @@
     "node-pty@1.2.0-beta.15": true
   },
   "overrides": {
+    "patch-package": {
+      "find-yarn-workspace-root": "$find-yarn-workspace-root"
+    },
     "@ai-sdk/code-mode": {
       "run": "2.1.4"
     },

packages/runtime-host/package.json

@@ -44,6 +44,6 @@
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
-    "electron": "^43.4.1"
+    "electron": "^43.5.0"
   }
 }

patches/README.md

@@ -26,6 +26,17 @@ After a dependency upgrade, apply the still-needed edits to the new version
 before regenerating. The command records the installed files, not the old
 patch text.
 
+The root `overrides` replaces only patch-package's `find-yarn-workspace-root`
+with the repository-owned adapter in `scripts/npm-compat/find-workspace-root`.
+The upstream helper pulls in `micromatch` and `braces`; braces <=3.0.3 has no
+published fix for GHSA-vfj7-8cjw-p6xm. The adapter retains the synchronous
+workspace lookup contract using `picomatch` directly, without the vulnerable
+brace AST walkers. Patch creation and application still use patch-package 8.0.1.
+The direct local devDependency and `$find-yarn-workspace-root` override reference
+keep npm's file resolution anchored to the repository root. The adapter is
+tested by `node --test scripts/find-workspace-root.test.mjs` in CI.
+Remove the override once upstream ships a dependency chain without this advisory.
+
 Keep this directory small. Prefer product code that uses the dependency's
 published API; only patch for bugs that block shipping and cannot be worked
 around at the call site.

scripts/find-workspace-root.test.mjs

@@ -0,0 +1,100 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { test } from 'node:test';
+import findWorkspaceRoot from './npm-compat/find-workspace-root/index.cjs';
+
+function fixture(t, workspaces) {
+  const root = mkdtempSync(join(tmpdir(), 'maka-workspace-root-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  writeFileSync(join(root, 'package.json'), JSON.stringify({ private: true, workspaces }));
+  return root;
+}
+
+for (const workspaces of [['packages/*'], { packages: ['packages/*'] }]) {
+  test(`finds the root and a member with ${JSON.stringify(workspaces)}`, (t) => {
+    const root = fixture(t, workspaces);
+    const member = join(root, 'packages', 'one');
+    mkdirSync(member, { recursive: true });
+    writeFileSync(join(member, 'package.json'), '{}');
+    assert.equal(findWorkspaceRoot(root), root);
+    assert.equal(findWorkspaceRoot(member), root);
+    assert.equal(findWorkspaceRoot(join(root, 'unrelated')), null);
+  });
+}
+
+test('supports brace patterns, exclusions, and later re-inclusion', (t) => {
+  const root = fixture(t, ['{packages,apps}/*', '!packages/hidden-*', 'packages/hidden-allowed']);
+  for (const member of ['packages/core', 'apps/desktop', 'packages/hidden-allowed']) {
+    assert.equal(findWorkspaceRoot(join(root, member)), root);
+  }
+  assert.equal(findWorkspaceRoot(join(root, 'packages/hidden-secret')), null);
+  assert.equal(findWorkspaceRoot(join(root, 'other/member')), null);
+});
+
+test('supports exclusion-only patterns and negated extglobs', (t) => {
+  const root = fixture(t, ['!excluded/**']);
+  assert.equal(findWorkspaceRoot(join(root, 'included/member')), root);
+  assert.equal(findWorkspaceRoot(join(root, 'excluded/member')), null);
+  writeFileSync(join(root, 'package.json'), JSON.stringify({ workspaces: ['!(excluded)'] }));
+  assert.equal(findWorkspaceRoot(join(root, 'included')), root);
+  assert.equal(findWorkspaceRoot(join(root, 'excluded')), null);
+});
+
+test('stops at the nearest workspace boundary even when it excludes the member', (t) => {
+  const root = fixture(t, ['**']);
+  const nested = join(root, 'nested');
+  mkdirSync(nested);
+  writeFileSync(join(nested, 'package.json'), JSON.stringify({ workspaces: ['members/*'] }));
+  assert.equal(findWorkspaceRoot(join(nested, 'members/one')), nested);
+  assert.equal(findWorkspaceRoot(join(nested, 'other')), null);
+});
+
+test('empty workspace lists include only their root', (t) => {
+  const root = fixture(t, []);
+  assert.equal(findWorkspaceRoot(root), root);
+  assert.equal(findWorkspaceRoot(join(root, 'member')), null);
+});
+
+test('deeply nested braces do not exhaust the call stack', (t) => {
+  const root = fixture(t, [`${'{'.repeat(5000)}member${'}'.repeat(5000)}`]);
+  assert.doesNotThrow(() => findWorkspaceRoot(join(root, 'member')));
+});
+
+test('returns null without a workspace and reports invalid manifests', (t) => {
+  const root = fixture(t, undefined);
+  assert.equal(findWorkspaceRoot(root), null);
+  writeFileSync(join(root, 'package.json'), '{broken');
+  assert.throws(() => findWorkspaceRoot(root), SyntaxError);
+});
+
+test('patch-package resolves the adapter and it recognizes this npm workspace', () => {
+  const require = createRequire(import.meta.url);
+  const fromPatchPackage = createRequire(require.resolve('patch-package/package.json'));
+  const installedFindRoot = fromPatchPackage('find-yarn-workspace-root');
+  assert.equal(installedFindRoot, findWorkspaceRoot);
+  const root = resolve(import.meta.dirname, '..');
+  assert.equal(installedFindRoot(join(root, 'apps/desktop')), root);
+  assert.equal(installedFindRoot(), root);
+});