celebrate is declared in project-history's package.json but never imported
anywhere in the service. Dropping it removes one of the consumers pulling in
joi@17 and shrinks the dependency surface. docstore still uses celebrate, so
it remains in the lockfile.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 171c3e5435495d20256bd9b95158a275ec42f7e3
* [Security upgrade] bump tmp to ^0.2.6 in jobs/mirror-documentation (GHSA-ph9p-34f9-6g65)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Update yarn.lock: resolve tmp@^0.2.6 to 0.2.7
The lockfile had no entry for the ^0.2.6 range, causing Yarn to try
adding tmp@0.2.7 at CI time. With CI=true Yarn runs in --immutable mode,
so the unrecorded resolution failed every build. Ran yarn install locally
to record the ^0.2.6 → 0.2.7 resolution before pushing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 5f62c586817c6a35c77a2bd0ff1990897d574338
* Pin @babel/plugin-transform-modules-systemjs to 7.29.4 via resolutions (GHSA-fv7c-fp4j-7gwp)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Fix missing comma in package.json resolutions
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Jakob Ackermann <jakob.ackermann@overleaf.com>
GitOrigin-RevId: d6f3e72234d64fd0afb8676b8652cc03b0cddbe0
Adds a resolution in root package.json to force all consumers to
@xmldom/xmldom@0.8.13, fixing GHSA-wh4c-j3r5-mjhp, GHSA-j759-j44w-7fr8,
GHSA-x6wf-f3px-wcqx, GHSA-f6ww-3ggp-fr8h, and GHSA-2v35-w6hq-6mfw.
The vulnerable 0.7.13 entry in yarn.lock is replaced by 0.8.13
(minimum safe version across all five advisories).
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: e1a301e3a1d637894284f35238ca0e8c23534276
Fixes GHSA-cf4h-3jhx-xvhq (critical, arbitrary code execution) and
GHSA-qpx9-hpmf-5gmw (high, DoS via _.flatten/_.isEqual).
Vulnerable underscore@1.7.0 came from js-yaml@2.1.3 → argparse@0.1.16.
All other instances were already ≥1.13.8.
GitOrigin-RevId: b2ab4bc2682e19709694b7dd686134a439ade90c
Lucie Germain