[arrzdev]

Four packages in pnpm-lock.yaml resolved versions with published advisories. All four are runtime dependencies of adaptv.

Package	Before	After	Advisory	Fix
seroval, seroval-plugins	1.6.9	1.7.6	GHSA-f86p-h4j2-7qgj (<1.6.11), GHSA-9wx9-5pv9-3349 (<1.6.10)	lockfile refresh inside @tanstack/router-core's own ^1.6.7 range. The router is not bumped.
glob	11.1.0 (workbox-build), 13.0.6 (rimraf ← @capacitor/cli)	14.0.3	GHSA-3g3m-2fjr-6pw4 (>=9 <=14.0.1)	override. workbox-build 7.4.1 and rimraf 6.1.3 are the latest releases and still pin ^11 / ^13.
minimatch	10.2.5 (glob), 5.1.9 (filelist ← jake ← ejs ← workbox-build)	11.0.3	GHSA-g3hv-75wg-m249 (<11.0.1)	glob 14 already depends on ^11. filelist gets a scoped filelist>minimatch override.
deepmerge	4.3.1	4.3.1	GHSA-gcqx-w48m-w2h4 (low, >=4.2.0 <=4.3.1)	not changed: no patched release exists.

The overrides live in pnpm-workspace.yaml, with a comment on each entry. The comment says why the entry is there and when to drop it.

API compatibility:

• workbox-build calls only globSync and rimraf calls only glob / globSync. Both exist unchanged in glob 14.
• filelist calls minimatch.match, which minimatch 11 still exports. filelist is reached only through ejs's jake CLI, and ejs's library never requires it.

About deepmerge: it is reached only through @rollup/plugin-node-resolve (inside workbox-build). There it merges the plugin's own build options at service-worker build time, and no untrusted input reaches mergeObject.

Reproduce:

pnpm why seroval glob minimatch   # on main: seroval 1.6.9, glob 11.1.0 + 13.0.6, minimatch 5.1.9 + 10.2.5

Verify:

pnpm install --frozen-lockfile
pnpm why seroval glob minimatch   # seroval 1.7.6, glob 14.0.3, minimatch 11.0.3, one version each
pnpm gate

Results on this branch:

• pnpm gate: green. 338 test files passed (5011 tests), and build:check passed.
• pnpm --dir playground test:e2e:sw --project=chromium: 28 passed, 5 skipped. This suite exercises the workbox precache build, which uses glob.
• pnpm --dir playground test:e2e --project=chromium: 466 passed, 5 skipped, 3 failed. The 3 failures were Chrome's "Socket path too long" at browserType.launch under the VM's long TMPDIR. They passed on a re-run of e2e/app-state.spec.ts and e2e/browser.spec.ts with a short TMPDIR (7 passed, 1 skipped). This suite covers SSR, where seroval serialises router state.

The overrides block sits above patchedDependencies, because create.test.mjs reads every 'key': value line after that key as a patch entry.

Also smoke-checked directly with the new versions: filelist FileList.include() matched 8 files, workbox-build getManifest() returned 456 entries, and rimraf { glob: true } resolved.

Tested on: Linux x64, Node 22.23.3, pnpm 11.1.1.
Not tested: macOS/Windows, Android/iOS builds.