Update transitive dependency overrides to fix security audit

[DonOmalVindula]

Purpose

Fixes the repo-wide Security Audit CI gate (pnpm audit --audit-level=high), which started failing because three advisories were re-scoped to wider version ranges than the existing transitive-dependency overrides in pnpm-workspace.yaml covered. This is not tied to any feature change; it surfaced on open PRs (e.g. #4161) because the gate runs on every PR.

All three packages are deep transitive dependencies (via docusaurus, eslint, rimraf, webpack-dev-server), so they are updated through pnpm overrides rather than a direct package.json bump.

Approach

Updated the stale overrides to patched versions:

• brace-expansion (GHSA-3jxr-9vmj-r5cp, DoS): advisory now covers <1.1.16 (1.x line, previously unhandled) and >=3.0.0 <5.0.7 (old override capped at 5.0.5, still vulnerable). Now overrides <1.1.16 -> 1.1.16 and >=3.0.0 <5.0.7 -> 5.0.7.
• js-yaml (GHSA-52cp-r559-cp3m, quadratic CPU via merge keys): advisory >=4.0.0 <4.3.0; old override capped at 4.2.0, still vulnerable. Now >=4.0.0 <4.3.0 -> 4.3.0.
• shell-quote (GHSA-395f-4hp3-45gv, quadratic DoS in parse()): advisory <=1.8.4. The old @thunderid/docs>shell-quote: 1.8.4 scope only matched a direct child of the docs package, so it never applied to the actual ...launch-editor>shell-quote path. Replaced with a global shell-quote: >=1.8.5 override.

Regenerated pnpm-lock.yaml. Local pnpm audit --ignore-registry-errors --audit-level=high now reports 0 high-severity findings.

Related Issues

N/A

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
• Breaking changes. (Fill if applicable)

Security checks

• Followed secure coding standards in WSO2 Secure Coding Guidelines
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Bug Fixes
  • Updated dependency security overrides to address vulnerabilities affecting shell-quote, brace-expansion, and js-yaml.
  • Expanded shell-quote protection across the workspace.
  • Refined version constraints to ensure secure dependency resolutions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d1cd03d-e6ed-4921-aa1a-cdff7b3eb4c9

📥 Commits

Reviewing files that changed from the base of the PR and between 34d5e25 and 5f31d8d.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

Updated pnpm-workspace.yaml dependency overrides to broaden shell-quote coverage and revise brace-expansion and js-yaml vulnerable-version mappings.

Changes

Dependency override remediation

Layer / File(s)	Summary
Update advisory override rules pnpm-workspace.yaml	The shell-quote override is now workspace-wide, while brace-expansion and js-yaml use updated vulnerable-version ranges and resolutions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• thunder-id/thunderid#4036: Updates pnpm-workspace.yaml dependency overrides for a separate security advisory.

Suggested reviewers: copilot, brionmario, jeradrutnam, sadilchamishka

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: updating transitive dependency overrides to fix security audit failures.
Description check	✅ Passed	The description mostly matches the template with clear Purpose, Approach, checklist, and security sections; only Related PRs is not explicitly filled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates pnpm transitive dependency overrides (and regenerates the lockfile) to restore the repo-wide pnpm audit --audit-level=high security gate by forcing patched versions of vulnerable deep dependencies used by tooling like Docusaurus and related dev-server chains.

Changes:

• Replaced the docs-scoped shell-quote override with a global override (>=1.8.5) so it applies to the actual transitive path(s).
• Updated brace-expansion overrides to cover both the 1.x and 3.x/4.x vulnerable ranges with patched versions.
• Updated the js-yaml override for the vulnerable >=4.0.0 <4.3.0 range and regenerated pnpm-lock.yaml.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Updates security-motivated overrides to patched versions for affected transitive dependencies.
pnpm-lock.yaml	Lockfile regeneration reflecting the new override resolutions (e.g., shell-quote/brace-expansion/js-yaml).

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!